QR Code Scams: How They Work and How to Stay Safe

QR (Quick Response) codes have become part of everyday life — used for restaurant menus, parking payments, product packaging, event tickets, and even wedding invitations. Their convenience is exactly why scammers have started exploiting them. This type of fraud, sometimes called “quishing” (a blend of QR code and phishing), has grown rapidly because QR codes hide their destination until you scan them, making it easy to disguise malicious links as legitimate ones.

Here’s a detailed breakdown of how these scams work and practical steps to protect yourself.

How QR Code Scams Work

1. Malicious Code Overlays (Physical Tampering)

Scammers print fake QR code stickers and paste them over legitimate ones in public places — parking meters, restaurant tables, gas pumps, flyers, or posters. When someone scans it expecting to pay for parking or view a menu, they’re redirected to a fraudulent website instead.

2. Phishing via Email or Mail

Instead of a suspicious link (which email filters might catch), scammers embed a QR code in an email, text message, or even a physical letter. Because QR codes are images, they often bypass spam filters and security scanners that look for malicious URLs in text.

Common disguises include:

• Fake delivery notices (“Your package couldn’t be delivered — scan to reschedule”)
• Fake tax or government notices
• Fake unpaid toll or parking ticket notices
• Fake two-factor authentication or account verification requests

3. Fake Payment or Donation Requests

Scammers create QR codes for fraudulent payment collection — fake charity donations, fake vendor payments, or fake “split the bill” requests — redirecting money into their own accounts.

4. Malicious App Downloads

Some QR codes redirect to a page that automatically prompts a download of a malicious app disguised as something legitimate (a “parking app,” a “loyalty rewards app,” etc.). Once installed, this app can steal data, log keystrokes, or gain access to your device.

5. Credential Harvesting

The scanned code leads to a spoofed login page (mimicking your bank, Microsoft 365, Google account, or a delivery service). When you enter your username and password, it goes straight to the attacker.

6. Cryptocurrency and Payment App Scams

Scammers share QR codes claiming to offer investment opportunities, “free” cryptocurrency, or refunds — but the code actually links to a wallet address that sends your funds to the scammer.

Why QR Code Scams Are Effective

• Invisible destination: Unlike a text link, you can’t see the URL before scanning, so you can’t visually spot a suspicious domain.
• Trust by association: People assume a QR code on official-looking signage, packaging, or stationery is legitimate.
• Mobile-first design: Most QR scans happen on phones, where security software is often less robust than on desktops, and where it’s harder to scrutinize a URL in a small mobile browser bar.
• Urgency and fear tactics: Many scam QR codes are paired with urgent language (e.g., “your account will be suspended,” “final notice”) to prompt quick action without careful thought.
• Bypasses email security filters: Because the malicious content is an image rather than embedded text, many spam/phishing filters don’t catch it.

Red Flags to Watch For

• A QR code sticker looks slightly off-center, peeling, or pasted over another code
• Unsolicited QR codes in emails, texts, or physical mail — especially from unknown senders
• Urgent or threatening language urging immediate action
• Requests to “verify” your account, payment info, or personal details after scanning
• A QR code is the only way to complete an action (no alternative website or phone number given)
• Shortened or unfamiliar URLs after scanning (e.g., bit.ly links instead of a company’s actual domain)
• Requests to download an app or install a “browser update” after scanning
• Poor grammar or generic greetings on the landing page

How to Stay Safe From QR Code Scams

Before Scanning

1. Inspect physical QR codes closely. Look for signs of a sticker placed over the original code, especially on parking meters, posters, or public displays.
2. Be skeptical of QR codes in unsolicited messages. Legitimate companies rarely ask you to scan a QR code to “verify” an account or resolve an urgent issue — they’ll usually direct you to their official app or website.
3. Avoid scanning codes from unknown or unverified sources, including flyers, business cards from strangers, or social media posts promising freebies or giveaways.

While Scanning

4. Preview the URL before opening it. Most modern phone cameras show a preview of the link before you tap to open it — always check this. Look for:
   • Misspelled domain names (e.g., “arnazon.com” instead of “amazon.com”)
   • Unusual top-level domains for a supposedly local business (.ru, .cn, .info, etc.)
   • Extra subdomains designed to look legitimate (e.g., “amazon.security-verify.com”)
5. Don’t scan and enter your login credentials immediately. Type the company’s known URL directly into your browser instead of trusting the scanned link, especially for financial or account-related actions.

After Scanning

6. Don’t download anything prompted by a scanned QR code unless you’re certain of the source — legitimate apps should be downloaded through the App Store or Google Play, not a redirected link.
7. Never enter payment details on a page you reached via an unsolicited QR code. If you need to pay a bill, toll, or fine, go directly to the official website or app instead.
8. Watch for permission requests. If a scanned link asks for unusual permissions (camera, contacts, location, admin access), deny it and close the page/app.

General Protective Habits

9. Use a QR scanner app with built-in security checks (some show safety ratings or warnings for suspicious URLs), rather than relying solely on your phone’s default camera app.
10. Keep your phone’s OS and security software updated, since updates often patch vulnerabilities scammers exploit.
11. Enable multi-factor authentication (MFA) on your important accounts, so even if credentials are compromised, there’s an extra barrier.
12. Report suspicious QR codes — to the business or property owner if it’s a physical sticker, or to the FTC (reportfraud.ftc.gov) or your local cybercrime reporting agency if it was part of a phishing attempt.
13. Educate family members, especially older adults or those less familiar with tech scams, since they’re often targeted more heavily.

What to Do If You’ve Scanned a Malicious QR Code

• Disconnect from the internet (turn on airplane mode) if you suspect malware was downloaded.
• Do not enter any personal or financial information on the resulting page.
• Run a security scan using a reputable antivirus/anti-malware app.
• Change passwords immediately for any accounts where you may have entered credentials, and enable MFA if not already active.
• Monitor your bank and credit card statements for unauthorized transactions.
• Report the incident to your bank (if financial info was exposed), the FTC, and the platform or business whose branding was spoofed.
• Consider a factory reset if you suspect a malicious app was installed and you can’t identify or remove it.

Key Takeaway

QR codes themselves aren’t inherently dangerous — they’re simply a way to encode a link or data. The risk comes from the fact that you can’t see where a QR code leads until after you scan it, which scammers exploit through spoofed codes, urgent messaging, and convincing fake websites. Treating QR codes with the same skepticism you’d apply to an unfamiliar link — checking the source, previewing the destination, and never rushing into entering sensitive information — is the most effective defense.