QR Code Scams: How to Spot Fake and Tampered Codes (2026)

How QR code scams work

A QR code stores a web address. Your phone camera reads it and offers to open it. Scammers use that gap. The square looks the same whether it leads to a city parking site or to a copy of one that collects card numbers.

Security people call the attack quishing: phishing through a QR code. The aim is the same as in any phishing message. The fake page asks for a login, a card number, or a one-time code, or pushes you to install an app. The FTC warned in December 2023 that scammers send QR codes in texts and emails with made-up reasons to scan, and that a code can lead to a spoofed site or to malware (FTC consumer alert).

Where fake codes show up

Parking meters and pay stations

The FTC says people have reported scammers covering the real QR codes on parking meters with their own, and repeated that warning in September 2026 (FTC: See a QR code parked somewhere? Don’t scan it…yet!). The victim pays for parking on a fake page. The parking is not paid, and the card details go to the scammer. Before you scan, check whether the sticker sits over another one, and look at the signage for the official app or web address.

Unexpected packages and texts

The FTC has an alert on QR codes on unexpected packages, where the code leads to phishing sites or malware (FTC: Scam alert, QR code on an unexpected package). It has also warned that texts about a traffic violation, sometimes with a QR code, are a scam (FTC alert). Our guide to toll and delivery texts covers the same pattern.

Menus, posters, and flyers

Any printed code can be overstuck. A sticker on a table, a poster in a shop window, or a flyer on a car windscreen can point somewhere else. Those places are not unsafe by default, but a menu does not need your bank login, and a flyer offering a prize for scanning deserves a pause.

Payment and “receive money” codes

In payment apps a code can set up a payment to someone. A stranger who asks you to scan to “receive” a refund or buyer’s payment is setting up a charge. See bank transfer scams for the UPI-style version of this trick.

Eight warning signs

1. A sticker stuck over another code. Run a fingertip over the code. A sticker with raised edges, a slightly different size, or glue marks may have been placed over the real one. The FTC has warned that scammers replace QR codes on parking meters with their own.
2. A code in an unexpected text, email, or letter. A QR code about a missed delivery, a locked account, a toll, or a traffic fine is a prompt to be suspicious. The FTC has also warned about QR codes on unexpected packages. Do not scan. Contact the company using its own website or app.
3. A web address that is slightly wrong. Most phones show a link preview before opening. Read it. Look for extra words, swapped letters, or an unfamiliar domain. A link shortener hides the real destination, so treat it with more care.
4. A page that asks for card details, a login, or a one-time code. A parking, menu, or Wi-Fi page rarely needs your bank login or a verification code. If it does, close it and use the official app or website instead.
5. A request to install an app or approve a permission. If the code sends you to a download page you did not expect, stop. Install apps only from your phone’s official store, and only after you have searched for the app yourself.
6. Urgency attached to the code. Fines due in hours, accounts closing today, and parcels that will be returned are pressure tactics. Real organizations give you time and other ways to pay.
7. A payment page that does not match the place. If you scan a code on a meter and the page names a different company, or shows a different location code, back out. Check the signage for the official parking app or web address and type it in yourself.
8. A code that asks you to “pay” a person or approve a payment. A payment QR code can send money to a stranger. In payment apps, check the payee name before you confirm. Never scan a code to receive money: receiving does not need a PIN.

A safer way to scan

• Use your phone’s built-in camera, which can show the link before it opens, rather than installing a separate scanner app.
• Read the preview link before you tap. If it is shortened or odd, do not open it.
• For anything involving money, go to the official app or website instead of using the code.
• Keep your phone’s operating system and apps updated, use strong unique passwords, and turn on multi-factor authentication.
• If a business gives you a code, ask yourself whether you could complete the task without it.

If you already scanned or paid

1. Close the page. If you installed an app you did not choose, delete it and run your phone’s security scan.
2. Call your card issuer or bank on the number on the card if you entered card details. Ask to block and replace the card, and review recent charges.
3. Change passwords you typed into the page, and any account that reuses them, through the official site or app. Turn on multi-factor authentication.
4. Tell the venue or parking operator so the code can be removed. Take a photo of the sticker first.
5. Report it. See below. If money left your bank account by transfer, read bank transfer scams and call your bank at once.

Where to report

• United States: ReportFraud.ftc.gov (FTC) and ic3.gov (FBI IC3).
• United Kingdom: Report Fraud (formerly Action Fraud), 0300 123 2040. In Scotland, call Police Scotland on 101.
• Australia: Scamwatch, and ReportCyber.
• Canada: the Canadian Anti-Fraud Centre, 1-888-495-8501.
• India: National Cyber Crime Reporting Portal or helpline 1930.

More help from official sources

• FTC: Scammers hide harmful links in QR codes
• FTC: See a QR code parked somewhere? Don’t scan it…yet!
• FTC: Scam alert, QR code on an unexpected package

Scambaba is an independent educational project. Reporting and recovery options depend on where you live. How these guides are researched is on the editorial policy.

Frequently asked questions