A fake QR code on a trail sign is a sticker that looks like a map or information link but sends the person scanning it somewhere else, and one has just been reported at the foot of Esja mountain near Reykjavík, Iceland. According to a report published on 28 October 2026, a hiker scanned the code expecting a map and was met with a payment request instead.
What was reported on the Esja trail
The story was published by Daily Northern, which cites the Icelandic outlet mbl.is. It describes an information sign next to the Mógilsá forestry centre, on a walking route at the foot of Esja. A woman named Rán Tryggvadóttir, who was out walking with her husband, scanned the QR code on the sign hoping to see a map of the area.
No map appeared. Her phone reportedly showed a payment request for one euro cent, which she approved in what she described as a moment of confusion. An unusual web page then loaded. The payment was linked to her debit card with the digital bank Indó. The account held no money, so later payment requests were rejected, and she has since closed it. The report says further requests followed but does not say how many.
Auður Kjartansdóttir, executive director of Reykjavík Forestry, told the outlet that someone had put a sticker on the sign. She pointed to a similar case at Heiðmörk, where a forestry employee peeled a sticker off a sign, and said she had been told this was not the first sticker of this kind found on a sign in a recreation area. These details come from a single secondhand report, so treat the specifics, including the exact amounts and sequence, as reported rather than independently confirmed.
Why a fake QR code on a trail sign works
Outdoor signs are close to ideal for this trick, for reasons that have nothing to do with technology:
- Nobody is watching them. A trail sign can sit for weeks between inspections, so a sticker can stay up long enough for several people to scan it.
- People expect a code. Hikers and tourists are used to scanning a code for a map, a weather warning or a trail status. A sticker in the usual place does not raise questions.
- Phones are the only check. A QR code is a pattern of squares. Looking at it tells you nothing about where it goes, so a real code and a pasted one look equally official.
- The signal is weak and the user is distracted. On a hillside, in wind, with gloves on, people tap the first thing that appears.
This is the outdoor version of what we described in our article on fake QR code stickers on parking meters. The sign is different, the method is the same: a cheap physical overlay on a code that people trust because of where it is.
What a payment request tells you about the attack
The unusual part of the Esja case, as reported, is that the first thing the scan produced was a payment request rather than a login page. A request for a tiny amount can be a test of whether a card or account is live and whether the person will approve something without reading it. We cannot say what the operators intended, and the report does not either. The practical lesson is simple: a map should never need a payment approval. If a code you scan to read something suddenly asks to take money, stop and close it.
Wider guidance on spotting a bad code is in our guide are QR codes safe?, which covers the preview your phone shows before it opens a link.
What software cannot fix
We make one of the tools this article is about, so we will be direct: no QR platform can stop someone sticking a fake code over yours. The sticker is a physical object, it is not created on your account, and nothing in a dashboard can remove it. If you look after signs in a park, a forest, a campsite or a visitor centre, someone still has to walk the route and look.
That matters because the reported fix at Esja and Heiðmörk was exactly that: a person removing a sticker. The most reliable defences are physical ones.
- Print the code on the sign itself rather than on a removable sticker, or use a tamper-evident label that tears when lifted.
- Photograph every sign when it is installed, so a covered or swapped code is obvious on the next inspection.
- Print the web address in words under the code, so a visitor can type it and does not have to trust the pattern.
- Put a clear notice on the sign that the code never asks for payment.
Where a dynamic QR code helps the owner
A dynamic QR code does not prevent tampering, but it gives the owner of the genuine code several options a printed static code does not. For background on how it works, see what a dynamic QR code is.
Re-point or pause a genuine code in seconds
A dynamic code sends people through a short address that you control. You can change where it points, or pause it, and the change applies to every printed copy within seconds. If you learn that signs in one area are being targeted, you can send your real codes to a page that says what to look for, and the map link can follow once the signs are checked.
Use one code per sign
If each sign has its own code, the scan log shows which ones normally get scans. On paid plans, QR code tracking records each scan with its country, city and device, and bot filtering keeps link previews and crawlers out of the numbers. A sign that is usually busy and suddenly goes silent is a reason to go and look. That is a hint and not proof, because a quiet week may just be bad weather. Pro plans add scan alerts and webhooks, which can tell you when a code is scanned unexpectedly, for example from a country far from the trail.
Keep the destination simple
For a map or a trail notice, a code that opens a PDF is easy to keep current. Our PDF QR code generator lets you replace the file without reprinting the sign. A code on your own domain, available on Pro plans, shows your name in the phone preview; see how to use a custom domain for your QR codes.
Codes do not expire by accident
Codes have no expiry unless you set one, and free-plan codes stay live. That means a genuine map sign will not quietly stop working, which is a separate problem we cover in do QR codes expire?
What visitors should do
- Look at the sign first. A sticker on top of printed material, a code with a different border, or one that is larger than the rest is a warning sign.
- Read the preview. Your phone shows the address before it opens. If it does not match the park or the operator, close it.
- Never approve a payment to read a map. If a request appears, decline it.
- If you approved something, contact your bank or card provider straight away and report the sticker to the sign owner and the local police.
The takeaway for sign owners
The Esja case, as reported, involved a one-cent payment and no apparent lasting loss, since the account was empty and has been closed. It could have gone differently for someone using a funded card. The sign owner's job is to make tampering rare and quick to spot. A QR platform can make your genuine codes easier to watch and change, but the sign inspection round is what actually catches a sticker. If you want to try the dynamic side, you can create a code for free and see what the scan log records.