QR code scams: how to spot them
A QR code hides where it leads until you scan it, and scammers take advantage of that. The FBI warned about tampered codes in 2022, and the US Federal Trade Commission issued a similar alert in 2023. A few simple habits protect you.
How the scams work
- Fake stickers over real codes. Scammers put their own code on parking meters, restaurant tables and posters, leading to a fake payment page.
- Codes in emails and texts. A message says there is a problem with your account or a parcel and asks you to scan. Using a code makes the dangerous link harder for email filters to spot.
- Parcels you didn’t order. A code in an unexpected delivery asks for your details.
- Fake “receive money” codes. Someone paying you, for example when you sell something online, asks you to scan a code to receive the money. Scanning a payment code usually sends money. It doesn’t receive it.
Warning signs
- A sticker placed over another code, or one that looks freshly stuck on or badly aligned.
- A message that creates urgency: your account is locked, a fine is due, or a parcel will be returned.
- A web address that is nearly right, misspelt or unrelated to the company.
- A short link that hides the real address.
- A login, card details or an app download you weren’t expecting.
How to stay safe
- Read the web address your phone shows before you open it.
- Don’t scan a code in a message you weren’t expecting. Go to the company’s website or app yourself.
- For parking and bills, use the official app or website if you are in any doubt.
- Only install apps from your phone’s official app store, never from a scanned link.
- Don’t enter a password or card number on a page you reached by scanning a code in a public place.
If you have already scanned one
Scanning alone usually does nothing until you open the link and act on it. If you did enter something:
- Payment details: contact your bank or card company straight away.
- A password: change it now, and on any other site where you use the same one.
- An app you installed: remove it and run your phone’s security check.
- Report it to your national fraud or cybercrime agency, or to the place whose code was covered.
If you run a business
Check your printed codes regularly, especially outdoors, and scan them to confirm they still lead to the right page. Tell customers what the address should be, by printing it next to the code. Tamper-evident labels or codes behind glass make stickers harder to add.
See what is inside before you open it
Our free scanner shows what a code contains and flags warning signs such as short links, without opening anything until you choose to. It runs on your device, so nothing is uploaded. If a code made on this site was used to mislead you, please report it to us.
Next steps
Last updated: 4 November 2026