Check a QR code by reading the link preview before you tap it, confirming it matches the real business name and spelling, and never entering a password or card number on a page you reached by scanning a code you didn’t expect. Scammers hide fake QR codes on packages, parking meters, invoices, and text messages to send you to a lookalike website that steals your login or payment details. If you already scanned one and entered information, the fastest fix is changing your passwords and watching your accounts right away.
Warning Signs of a QR Code Scam
In This Article
Watch for these red flags before you scan anything:
- The code arrived somewhere you didn’t expect it, like taped to a parking meter, stuck inside an unrequested package, or texted to you out of nowhere.
- The message pushes urgency, such as claiming your package needs “confirmation,” your account has a “problem,” or a payment is “overdue.”
- There’s no sender name, or the sender claims to be a company but gives no other way to contact them.
- The code looks like it’s stuck on top of another code, sign, or printed material.
- You’re asked to “scan to find out” who sent something, rather than being given a name up front.
Where Scammers Hide Fake QR Codes
These are the most common places official sources have flagged.
Unexpected Packages
The Federal Trade Commission warns that an unexpected package may arrive with a note claiming it’s a gift and instructing you to scan a QR code to find out who sent it or how to return it. Scanning that code can take you to a phishing site built to steal information like credit card numbers, usernames, and passwords, or it can install malware on your phone. If you’re confident the package really is a gift, federal law says you’re allowed to keep it.
Parking Meters and Payment Kiosks
A known tactic involves scammers placing a fake QR code sticker directly over the real payment code on a parking meter or kiosk. The fake sticker sends you to a lookalike payment page instead of the official system. Before you pay, check whether the sticker looks like it was placed over another code, and compare it to the payment method printed on the meter itself, such as an app name or phone number.
Invoices and Bills
A QR code on a bill that claims to be from a utility, toll agency, or delivery company can lead to a fake payment page instead of the real one. Treat a QR code on any invoice the same way you’d treat a link in an email: verify it separately before you pay.
Texts, Emails, and Social Messages
Phishing messages usually arrive as an email, text, direct message, or phone call designed to look like they’re from a trusted person or organization. Common warning signs include urgent or emotionally appealing language claiming dire consequences for not responding right away, along with requests for personal or financial information.
How to Check a QR Code Before You Scan
- Use your phone’s built-in camera preview. Most phones show the destination link before you open it — read the full address, not just the beginning.
- Look for misspellings or extra characters in the web address, like a swapped letter or an unfamiliar ending.
- If the code claims to be from a company you know, don’t use the link it gives you. Open a browser and type the company’s website address yourself, or search for it.
- If a code appears stuck on top of another code or sign, don’t scan it. Contact the business or agency directly to confirm the correct way to pay.
- Never enter a password, Social Security number, or card number on a page you reached by scanning an unexpected code.
- When in doubt, don’t scan. Look up another way to reach the company, such as its official website or customer service number.
For a closer look at how scammers manufacture urgency to get you to act without checking first, see how to spot fake countdown timers and scarcity claims.
What to Do If You Already Scanned and Entered Information
If you scanned a QR code and entered your username and password on a website, change that password right away. Beyond that:
- Review your credit card bills and bank account statements for transactions you didn’t make.
- Consider steps like freezing your credit or placing a fraud alert on your credit report.
- If you think your identity was stolen, report it and get a personal recovery plan at IdentityTheft.gov.
- If the code arrived on a package, message the retailer or marketplace it claimed to be from so they can look into the seller.
- If you suspect the message was phishing, use the “report spam” option in your email or messaging app, then delete it. Don’t click any link inside it, including an “unsubscribe” link.
If the scam involved a product purchase or subscription, our guide on how to check a product’s real shipping and contact information walks through verifying who you’re actually dealing with. If it involved a supplement or health product, see how to report a suspected supplement problem.
Quick Decision Path
- Did you request this code, or expect it from this specific sender? If no, don’t scan it.
- Does the preview link match the exact company name with no misspellings? If no, don’t scan it.
- Is the code asking you to log in, enter a card number, or “confirm” personal details? If yes, close the page and contact the company directly through its official site instead.
- Did you already scan and enter information? If yes, move to the recovery steps above now.
Who Should Be Extra Careful
Anyone can be targeted, but scammers often count on situations where people feel rushed or unsure, including someone expecting a delivery, someone parking in an unfamiliar area, or someone managing bills for a family member. Take an extra moment to verify in these situations rather than scanning on the spot.
Frequently Asked Questions
Is it safe to scan a QR code from a company I recognize?
Recognizing the company name isn’t enough on its own, since scammers copy real logos and names. Check the actual web address shown in the preview before opening it, and if you’re unsure, go to the company’s website directly instead of using the code.
Can scanning a QR code infect my phone just by looking at it?
A malicious QR code can take you to a site that installs malware or steals information you enter, so the risk comes from opening the linked page and interacting with it, not from the code’s image alone.
What should I do with an unexpected package that has a QR code inside?
Don’t scan the code. If you’re confident it’s genuinely a gift, federal law says you’re allowed to keep the item. If you’re unsure who sent it, contact the retailer it claims to be from through their official website instead of using any code in the package.
Where do I report a QR code scam?
You can report a suspected scam to the FTC, and if you think you’re a victim of identity theft, IdentityTheft.gov provides a personal recovery plan. For phishing messages specifically, use your email or messaging app’s built-in report option before deleting the message.
Educational Disclaimer
This article is for general educational purposes and is not legal, financial, or law enforcement advice. It does not cover every scam variation, and scam tactics change over time. If you’ve lost money or believe your identity was compromised, contact your bank or card issuer directly and consider reporting to the FTC and IdentityTheft.gov for guidance specific to your situation.
