QR Codes on Trucks, Signs and Invoices: Tampering Risk

Why this matters

A QR code is a link nobody can read. A customer who scans the code on your truck door, your yard sign or your invoice cannot tell where it goes until the page is already open, and by then a well-made fake looks exactly like your payment page. A thief does not need to touch your website, your email or your bank to exploit that. He needs a sheet of printed stickers and ten minutes in a parking lot. When it works, your customer pays a stranger, believes they paid you, and finds out when your second notice arrives.

How the attack actually works

The industry name is quishing, phishing delivered by QR code. In a service shop it comes in three shapes, and they need different defenses.

• The overlay. A sticker printed with a different code is placed squarely over yours. It is the most common shape because it is the cheapest: no access to anything, just proximity. Trucks parked overnight, yard signs left at a finished job, and a laminated sheet taped inside the office door are all exposed.
• The substitute document. A fake invoice or "past due" notice arrives by mail or email carrying your name, your logo copied off your website, and a code that goes to the thief's checkout page. Nothing of yours was touched. This one leans on the customer already expecting a bill from you.
• The orphaned code. A code you printed years ago points to a short-link or "dynamic QR" service you stopped paying for, or to a domain you let lapse. The link stops working, or somebody else buys the domain and the code on fifty old door hangers now opens their page. No attacker acted against you at all; you left the door open.

The damage pattern is the same for all three. The fake page asks for a card, or for a bank login "to pay by transfer", or for a small "processing" amount that turns into a stored card. The customer blames you, because the code was on your truck.

The one design rule that defeats most of it

A code must go to an address on a domain you own and control, and that address must be printed in plain text beside the code. Everything below is a variation on that rule.

The printed text does two jobs. It lets a careful customer type the address instead of scanning, and it gives everyone, customer and tech alike, something to compare the scanned result against. A sticker overlay can copy your logo but it cannot change the letters printed under it without a second, more obvious sticker.

+--------------------------------------------+
|  [ QR CODE ]   Pay or book online:         |
|  [         ]   yourshop.com/pay            |
|  [         ]                               |
|                We never ask for payment    |
|                from a sign or a sticker.   |
|                Check the address bar.      |
+--------------------------------------------+
  code, printed address and warning on ONE
  vinyl piece, so an overlay has to cover
  the words too, which is easy to see

Use a short, readable path such as /pay or /book on your own domain, and have it redirect to wherever the real portal lives. That one indirection is what lets you change payment providers, rebuild the website or retire a service without reprinting a single truck, because the code never pointed at the vendor in the first place.

Where to put codes, and where not to

Not every surface carries the same risk, because not every surface asks for money.

Two judgment calls follow from the table.

Keep payment off the public surfaces. A truck and a yard sign have no reason to take money, so do not let a code there go to a payment page at all. A customer who has learned "the truck code is for booking" is far harder to fool than one who has learned "you can pay by scanning things."

On invoices, the code should open the specific invoice, not a generic form. A portal link that loads "Invoice 1042, balance due, your name" is something a substitute document cannot reproduce, because the thief does not know the invoice number or the balance. A generic "enter amount" page is exactly what he can copy.

What changes the answer: a shop that does no online payments at all (cash, check and card at the door) can relax on the payment side and still needs the overlay defense, because an overlay can send a customer to a fake "booking" page that collects their address and phone for a later phone scam. The risk drops; it does not disappear.

Making the physical code hard to cover

• Print the code as part of the vinyl graphic, not as a separate sticker. If the code is a stuck-on square, a stuck-on square over it looks normal. If it sits inside the door graphic with the address under it, an overlay is a visible patch.
• Use a laminate or over-laminate on signs and truck graphics. Stickers still adhere, but they sit proud of a glossy surface and catch the eye and the thumb.
• Avoid codes on anything the shop does not see daily. A truck comes back to the yard every night. A yard sign at a finished job may sit for three weeks. If the sign must carry a code, pull it within a stated number of days, such as seven, or print it without one.
• Do not print a code you cannot keep alive. Before using a dynamic QR or short-link service, ask what happens to the code if you stop paying. If the answer is "it stops working" or "it shows our ad", route it through your own domain instead.

The check: what to look at, and how often

The check takes under a minute per truck and is worth folding into something the crew already does.

1. Look first, then touch. Look at the code at an angle under light. A layered sticker shows an edge, a slight lift at a corner, a different gloss, or a code that is not perfectly square to the surrounding print. Run a thumb over it.
2. Scan it with the shop phone and read the address that the phone previews before opening. Most phone cameras show the destination before you tap it. It must match the printed text exactly, including the domain ending. yourshop.com and yourshop-pay.com are different businesses.
3. Open it and confirm it lands on the page you expect - booking for a truck code, the specific invoice for an invoice code.

A starting cadence that works for most shops: every truck weekly, on the same day as the fuel or inventory check; every yard sign at placement and at pickup; one in every batch of printed invoices or door hangers when the box arrives from the printer. Tune it to how long your vehicles sit unattended in public places.

Worked example: a pool route shop with fourteen trucks

A pool service shop runs fourteen route trucks and keeps about sixty yard signs in rotation. Every truck carries a door code; the signs carry one too. Invoices go out by email with a pay link, plus a printed copy for about a fifth of customers who asked for paper.

The finding. On the Monday walk-around, the tech on truck 9 notices the code on the tailgate is slightly raised at one corner. The phone preview reads a domain with the shop's name followed by "-billing" and a different ending. The printed address under the code is intact, because the shop's tailgate graphic has the code inside the vinyl and the sticker covered only the square. Truck 9 had been parked overnight on a residential street for four nights the previous week while the tech was on a long route.

What they did, in order, and why.

• Photographed the sticker in place before peeling it, with the truck number visible. That photo is what a police report, the platform hosting the fake page, and a customer asking "was that you?" all need.
• Checked the other thirteen trucks the same morning, not at the next weekly check. One overlay means somebody had stickers and a reason; the question was how many. They found one more, on truck 4, which had been parked on the same street one of those nights. Two of fourteen trucks, about one in seven.
• Checked the phone preview on a sample of yard signs at active jobs. Twelve signs were out; all twelve were clean. That matters because it narrows the exposure to the two trucks and roughly the four nights they sat on that street.
• Searched the inbox and the portal for a signal. Two customers had emailed in the past week asking why the payment page "looked different." Both had been sent to the fake page; one had entered a card. Nobody had connected the two emails, because each looked like a one-off complaint.
• Reported the fake domain to the registrar and hosting provider shown in a public domain lookup, using their abuse forms, with the photos attached. The page came down two days later. The shop also filed a police report, mainly so the customer who paid had a report number for her card dispute.
• Told customers on the route plainly, by text and email from the shop's usual number and address: the codes on two trucks were tampered with last week, the only real payment page is the address printed on every truck and invoice, and anyone who paid through a page with a different address should call the office. The customer who had paid was walked through a card dispute and her invoice was held, not sent to collections.

What the design choice bought them. Because the address was printed beneath the code on the vinyl, the tech caught it on sight, and the customer warning could point at something every customer could check. A shop whose truck carried only a bare code would have had nothing to compare against and nothing to tell customers except "be careful."

What the failure mode looked like. The two customer emails sat unanswered as separate complaints for five days. The cheapest fix in the whole story is a single rule for the office: any customer report of a payment page that "looked different", a strange address, or a charge they do not recognize is treated as a possible tampering report and sent to the owner the same day.

What to tell customers

Say it once, in the places customers already read, and keep it short: on the invoice, on the website's payment page, and in the confirmation text after booking.

• The address they should see when paying, written out.
• That the shop never asks for payment from a sign, a sticker, a truck or a flyer.
• That if a page asks for a bank login, a gift card, or a "processing" payment, it is not the shop.
• The phone number to call, which they should take from a past invoice rather than from the page in front of them.

Do not over-explain the attack. A customer needs the one habit, check the address, not a lesson in how criminals work.

How to tell your setup is right

• Every code the shop has ever printed is on a list with what it points to and where it is printed, and every destination resolves to your own domain. If you cannot list them, you cannot check them.
• Scanning any code shows a preview address that matches the text printed beside it, letter for letter.
• No public surface (truck, sign, flyer) points to a payment page.
• The domain the codes use renews automatically on a card that is current, and sits in the shop's own registrar account. See related: Your Domain Name Is the Master Key.

References

• See related: Your Domain Name Is the Master Key
• See related: Customers Got Texts Pretending to Be Your Company
• See related: Taking Card Payments in the Field Without Exposing Card Data
• See related: The Verify-on-a-Second-Channel Rule