QR codes are everywhere now. You see them on parking meters, restaurant tables, flyers, and even letters that show up in your mailbox.
Most of them are safe. But scammers have noticed how much we trust that little black and white square, and they have started making fake ones.
This guide explains how QR code scams work, where scammers tend to hide them, and the simple habits that keep you safe. You do not need to stop using QR codes. You just need to know what to check before you scan.
How do QR code scams work?
A QR code scam works by swapping a real code for a fake one that sends you to a scammer’s website instead. You scan the square with your phone camera, expecting to see a menu, a parking payment page, or a delivery tracking site. Instead, your phone opens a link the scammer controls.
Plain talk: QR code
A QR code is a small square pattern that your phone camera can read, similar to a barcode. Scanning it opens a website or app on your phone. QR stands for “quick response.”
Once you land on the scammer’s page, one of two things usually happens. The page might ask you to “pay” for parking, a toll, or a delivery fee, and any card details you type go straight to the scammer. Or the page might ask you to log into a fake version of a real website, such as your bank or email, so the scammer can steal your username and password.
The QR code itself cannot infect your phone just by being scanned. The danger comes from the website it opens, or from an app it tries to get you to install.
Where scammers hide fake QR codes
Scammers like QR codes because the code gives no clue about where it leads until you scan it. A sticker with a fake code can look almost identical to the real one next to it. Here are the places this shows up most.
| Where you see it | How the scam works |
|---|---|
| Parking meters | A sticker with a fake code is glued over or placed beside the real payment code |
| Mailed notices | A letter claims a package is held or a fee is due, with a QR code to “resolve” it |
| Flyers and posters | A fake code promises a prize, survey reward, or free item |
| Restaurant tables | A tampered sticker replaces the real menu code with one leading to a scam site |
| Emails and texts | A QR code image replaces a text link to slip past spam filters |
In January 2022, the FBI’s Internet Crime Complaint Center warned that criminals were tampering with QR codes in public places to redirect people to fraudulent sites that steal login and payment information, according to the FBI’s PSA on QR code tampering. That same month, officials in Houston, Austin, and San Antonio, Texas, found scam QR code stickers placed over legitimate codes on city parking meters, according to a Route Fifty report on the Texas parking scam. Houston’s parking department said the city does not use QR codes for payment at all, and confirmed the fake stickers were glued over its official parking payment stickers, according to the City of Houston’s parking alert.
The Better Business Bureau has also warned that scammers place fraudulent QR codes in emails, texts, and physical mail to direct people to phishing sites, according to the BBB’s QR code scam warning.
Safety tip
Never enter a credit card number on a page you reached by scanning a QR code at a parking meter. Most cities do not use QR codes for parking payment at all. Pay with the meter itself, the official city app, or a coin or card slot instead.
How to scan a QR code safely
You do not need to avoid QR codes altogether. A few habits make scanning much safer.
- Look before you scan. Check whether a sticker sits on top of another sticker, sits slightly crooked, or covers part of the original code.
- Read the web address your phone shows first. Your phone’s camera app shows a preview of the website address before you open it. Read it. If it looks like a string of random letters, a shortened link, or a company name spelled oddly, do not tap it.
- Never scan a code from an unexpected letter or package. A real company will not ask you to scan a code to “reopen,” “confirm,” or “release” a delivery you were not expecting.
- Skip codes offering prizes or rewards. A QR code on a flyer promising a free gift card is a common bait tactic.
- Use your phone’s built in camera, not a separate scanner app. Many third party QR scanner apps add ads or extra permissions you do not need. Your iPhone or Android camera already scans codes on its own, according to Apple’s guide to scanning QR codes.
Plain talk: link preview
A link preview is the small pop up your phone shows after scanning, with the website address written out before it opens. It gives you a chance to check the address before you commit to visiting it.
Try this
Before you scan any QR code in public, look closely at the sticker. Run a finger along the edge. A fake code stuck over a real one often has a slightly raised edge or a different texture than the surface around it.
What if you already scanned a bad QR code?
If you scanned a fake code but have not entered any information, close the browser tab and delete anything it tried to download. Your phone was not harmed just by opening the page.
If you already typed in a card number or password, act quickly.
- Call your card issuer’s fraud line and ask them to block the card and watch for unauthorized charges.
- Change the password for any account you may have logged into on the fake page, and turn on two factor authentication if you have not already.
- Report the scam. Our where to report a scam guide walks through exactly who to contact in the US, UK, Australia, and Canada.
- If you are not sure what to do next, our 10 minute checklist for scam links covers the same steps in more detail.
Say this
If you call your bank about a QR code charge, try: “I scanned a QR code that I believe was fraudulent, and I may have entered my card details on a fake website. Can you flag my card for review?”
QR codes on packages and mailed notices
Fake delivery notices are one of the more convincing QR scams, because a physical letter feels more trustworthy than a text message. A card or letter arrives claiming a package could not be delivered, a customs fee is owed, or an item is waiting at a depot, with a QR code to “reschedule” or “pay.” Scanning it leads to a payment page asking for a card number, or a form asking for personal details.
The pattern matches other delivery scams that arrive by text instead of mail. Our guide on package delivery text scams explains the same red flags, and the same rule applies here: real delivery companies track packages through their own apps and websites, not through a code on an unexpected letter.
If a notice about a toll, fine, or fee arrives with a QR code attached, treat it the same way. Our guide to the unpaid toll text scam covers a nearly identical trick sent by text message instead of mail.
Safety tip
A real government agency, delivery company, or bank will never ask you to scan a QR code to avoid a fee, reopen an account, or claim a package. When in doubt, look up the company’s number yourself and call them directly.
Watch for the payment red flags
QR code scams almost always end the same way: a request for money or card details. Watching how a scammer wants to be paid is one of the fastest ways to catch a scam in progress. Our guide on payment red flags covers gift cards, cryptocurrency, and other payment methods that should make you stop and question what you are being asked to do, whether the request arrived through a QR code, a phone call, or a text.
Where to go from here
QR codes are not going away, and most of the ones you scan every day are perfectly safe. The habit that matters most is a simple pause: look at the code, read the address before you tap it, and never pay or log in on a page you reached from an unexpected letter, flyer, or sticker.
If scam tactics like this worry you, our Scam-Stopper Kit (free when you join our email letter) walks through the most common tricks scammers use right now and how to shut them down. For a deeper, room by room look at protecting yourself and the people you love from scams, our book Scam-Proof covers this topic and many more in plain language, with large print and no jargon.
