A QR code is nothing more than a link you can scan with your phone camera. Scammers take advantage of that convenience by replacing real codes with fake ones, or planting their own where you least expect them. Knowing where these traps hide and checking a code before you scan keeps your money, accounts, and personal information safe.
What QR code scams are
A QR code scam starts with a code that leads somewhere it should not. Attackers swap a code you expect to use for their own, or plant a fresh one in a spot where people scan without thinking. The code itself is harmless. The page it opens is the problem: instead of a parking app or a menu, you land on a fake site built to look real.
These fake sites usually ask for a payment or a login. If you pay, the money goes to the scammer. If you log in, they now have your username and password.
Where QR code scams show up
Scammers put their codes where scanning feels routine. Common spots include:
- Parking meters and payment kiosks. A fake sticker placed over the real code sends drivers to a lookalike payment page.
- Restaurant menus. Codes handed to you at the table can be swapped or covered with stickers leading to fake ordering pages.
- Posters and flyers. Codes on event posters and help-wanted signs can be replaced or covered with new stickers.
- Stickers on packages. A delivery box can arrive with an extra sticker asking you to scan to reschedule the shipment.
- Emails that claim a package needs rescheduling. The message says your delivery failed and offers a QR code to fix it. It is the same pattern as smishing text scams: it arrives out of nowhere and pressures you to act fast.
How a QR code can steal without installing anything
QR codes do not install software on your phone. The scan simply opens a URL, the same as tapping a link in a message or email. That is what makes the trick hard to spot: nothing happens at the moment you scan.
The theft happens after. The fake page prompts you to enter a card number to pay for parking, or to sign in to track a package. They want the payment details and login credentials you type in.
Some of these pages are very good copies. They use the real logo, matching colors, and a web address that looks close to the official one. If you have ever received fake invoice emails that looked like real bills, the same trick is at work.
How to check a QR code before you scan
- Look at the URL before tapping through. After you scan, your phone shows a preview of the link. Read the address and check that the domain matches the company you expect.
- Do not scan codes on stickers placed over real ones. A genuine code is printed directly on the surface. A loose sticker on top, with a shiny edge, is a red flag.
- Inspect the sticker itself. Legitimate operators often print codes with a security tear line so that swapping them is obvious. If the code looks off-center or recently added, use another way to pay.
- Type the address yourself when it matters. For parking and payments, going to the official app or website directly is safer than trusting any code.
What legitimate QR codes look like
Honest uses of QR codes are common and convenient. Restaurant menus, event tickets, boarding passes, and payments in many shops rely on them. The difference is context. A menu code printed as part of the table card is normal. A code that suddenly appears on your door, or in an email you did not ask for, deserves more suspicion.
A real payment request from a company you use arrives in a predictable way. Fake payment emails arrive out of nowhere, and so does a mystery QR code.
The honest note: QR codes are just links
None of this means QR codes are dangerous by themselves. A QR code is a link, nothing more. Treat it the way you would treat a link you did not ask for. You would not open an attachment from an unknown sender, so do not scan a mystery code either.
If a code leads to a site that asks for money or a password, step back and verify. Find the official app, call the company using a number from their website, or open the site directly. The extra minute costs nothing compared with a drained account.
What to do if you paid or logged in through a fake code
- Contact your bank or card issuer right away and report the charge. Tell them the payment was part of a scam so they can open a dispute.
- Change the passwords on any account you logged into through the fake page. If you reuse passwords, change those accounts too.
- Turn on two-factor authentication on your email and bank accounts so a stolen password is harder to use.
- Report the scam to the FBI Internet Crime Complaint Center at ic3.gov. Warn anyone else who may have scanned the same code.
FAQ
Can a QR code install malware on my phone? No. Scanning a QR code only opens a link. The harm comes from the page it opens, which may trick you into paying or logging in.
How can I tell a fake QR code sticker from a real one? Check for a sticker placed over an existing code or sign. A shiny, loose, or uneven sticker is a reason to be suspicious.
Is it safe to scan a QR code to pay for parking? Usually, but check the URL preview before you finish. If the address does not match the official service, stop and use the official app.
I scanned a code and entered my card details. What now? Contact your bank immediately, change passwords on any account you signed into, and report the scam to the FBI.
Sources and further reading
---Written by Hassan Arshad, founder of UsefulOrbit. Last updated August 31, 2026.