Walk down any snack aisle or checkout lane and you'll see them: "Scan to win!" QR codes on chip bags, soda 12-packs, shelf danglers, and the bottom of your receipt. A scan is faster than typing a URL, which is exactly why brands love them for in-store sweeps — and exactly why scammers love slapping a sticker over the real one. The good news is that a legit QR sweep follows a predictable path, and once you know the path, the fakes stick out.

Follow where the scan actually lands 🖱️

A genuine QR giveaway routes you to the brand's own domain or a named promotions platform — think promo.brandname.com, or a well-known administrator like HelloWorld, Prime Data, or Snipp. Before you tap anything, look at the preview URL your phone camera shows before you open it. If a code on a Coke display resolves to coca-cola.com/promo, that's consistent; if it resolves to bit.ly/x9k2 or coca-cola-rewards-win.net, close it. Real sponsors almost never hide their landing page behind a link shortener for a national sweep, because the official rules have to name the sponsor and the site.

Once the page loads, confirm it looks like an entry form and not a login. A legit sweep asks for the minimum: name, email, maybe age or state for eligibility, and it links to Official Rules and a start/end date. It will never ask for your bank login, your full SSN, or a "processing fee" to enter — free means free under US sweepstakes law. If the page demands a password to an account you didn't create, or wants you to "verify" a credit card, back out. That's a phishing page wearing a giveaway costume.

Validate the receipt or PIN correctly

Many in-store sweeps are purchase-tracked or PIN-gated, so the scan is only half the entry. A receipt promo will ask you to enter the transaction number, store code, date, and time printed on your receipt — the system uses those to confirm a qualifying purchase and to enforce one entry per receipt. Photograph or keep the receipt until the promotion's stated verification window closes (often 7 to 30 days), because if you're selected, the sponsor may ask you to mail or upload it as proof. No receipt, no prize.

PIN-based codes work a little differently: a unique code printed inside the package or under a cap unlocks a single entry. That uniqueness is the whole security model, so treat the PIN like cash — don't post a photo of it online, and be suspicious of any "free" PIN shared in a comment thread, since it's likely already been redeemed. If a code errors as "already used" straight out of a sealed package, screenshot the message and contact the sponsor's promotion line rather than assuming you did something wrong.

Spot tampered and sticker-swapped codes

The fastest-growing in-store QR scam is the sticker swap: a fraudster prints their own QR sticker and presses it over the real one on a poster, shelf tag, or parking-sign-style display. Run a fingernail over the code. If you feel a raised edge, a second layer, or a code that's clearly a sticker sitting on top of printed packaging, don't scan it — peel-and-cover jobs are the tell. On printed retail packaging the QR is part of the artwork and can't be lifted; a standalone sticker on a bag or bottle deserves a hard second look.

Also weigh the context. A code taped to a gas pump, an ATM, or a random flyer promising a huge prize is far riskier than one printed directly on a national brand's box. When in doubt, skip the scan entirely and go to the brand's website by typing the address yourself — real sweeps are almost always listed there too, so you lose nothing by taking the long way in. 🔒

Preview the URL, keep your receipt, and never scan a sticker that peels — if the code hides its destination, it doesn't get your tap.