Security & Scams
QR Code Scams: How to Spot Fake Codes and Scan Safely
Written by Free Tech Support Editorial Team · Updated
QR codes are everywhere now: restaurant menus, parking meters, posters, bills and delivery notices. That convenience is exactly what makes a QR code scam work. A QR code is just a link you cannot read with your own eyes, so a criminal can swap a real code for one that leads to a fake payment or login page, and you will not notice until it is too late. This guide shows the most common QR code tricks, how to check where a code leads before you open it, and what to do if you have already scanned one and typed in your details.
This is an independent guide, not affiliated with any bank, city, parking company or phone maker.
How QR code scams work
The scam is the same as an ordinary phishing link, just hidden. Security people call it “quishing” (QR plus phishing). The code takes you to a website that looks like the real thing, such as a parking payment page, a bank login, a delivery company or your email provider, and asks you to enter a card number, a password or a one-time code. Some fake pages also push you to download an app or a file.
The US Federal Trade Commission has warned that scammers hide harmful links in QR codes, and that they often add urgency, such as a missed delivery or a problem with your account, so you scan before you think.
The most common QR code traps
Fake stickers on parking meters and pay stations
Criminals print their own QR codes and stick them over the real ones on parking meters, pay stations, signs and even electric vehicle chargers. You scan, see a page that looks like a parking payment site, and enter your card details, which go straight to the scammer. Warning signs:
- A sticker that sits on top of another code, has peeling edges or looks freshly added.
- A web address that does not match the city or the parking company named on the sign.
- A page that asks for more than it should, such as your full date of birth or an online banking password.
The safest option is to pay at the machine, or use the parking app you have already installed from the App Store or Google Play.
QR codes in emails and texts
Some phishing emails contain no clickable links at all, only a QR code. That helps them slip past email filters, and it moves you from a protected work computer to your phone. Typical messages say your password is about to expire, a document is waiting for you, or you need to “re-verify” your account. A real company rarely asks you to scan a code to sign in. Learn the other warning signs in our guide to recognizing a phishing email.
Codes in letters, flyers and packages
Watch for paper mail that looks like a parking ticket, an unpaid toll, a utility bill or a “final notice”, with a QR code to pay. Also be careful with an unexpected package you did not order that includes a card with a QR code. If you are not sure a letter is real, look up the organization’s contact details yourself instead of using the code or any number printed on the letter.
Codes in shops and online ads
Fake QR codes can also lead to online stores selling goods that never arrive. Before buying from a site you reached through a code, check it using our guide to shopping online safely and spotting fake stores.
How to scan a QR code safely
- Use the built-in camera. On an iPhone or iPad, open the Camera app and point it at the code; a link appears on screen. On most Android phones, the Camera app or Google Lens does the same (on some Samsung phones you may need to turn on QR scanning in the camera settings). You do not need a separate scanner app.
- Read the address before you tap. The preview shows the website. Look at the main domain name, which is the part just before the first single slash, such as “example.com” in “pay.example.com/park”.
- Look for red flags: misspellings (paypa1, amaz0n), extra words (citypark-payment-secure.site), unusual endings, or a link shortener that hides where it really goes.
- Remember that the padlock or “https” proves nothing. Scam sites use secure connections too.
- Do not enter payment or sign-in details on a page you reached from a code you did not expect. Close it, and go to the company’s website or app yourself.
- Never install an app or profile because a QR code told you to. Get apps only from the App Store or Google Play.
What to do if you already scanned and entered details
Act quickly; the sooner you move, the less damage a scammer can do.
If you entered card or bank details
- Contact your bank or card issuer through the number on the back of your card or its official app. Tell them what happened and ask them to block the card and dispute any charges.
- Check your recent transactions and keep watching your statements over the coming weeks.
If you entered a password
- Change that password immediately, and change it anywhere else you used the same one. A password manager makes unique passwords easy.
- Turn on two-factor authentication for the account.
- If you think someone has already got in, follow our guide to recovering and securing a hacked account.
If you downloaded an app or file
Delete it, run a security scan, and keep your phone updated. If your phone starts behaving strangely, ask your phone maker’s support site or a local repair shop for help.
Report it
- United States: report the scam to the Federal Trade Commission at reportfraud.ftc.gov. If the code was on a city meter or sign, also tell the city or parking authority so they can remove it.
- Canada: report it to the Canadian Anti-Fraud Centre through its website, and to your local police.
Reporting helps stop the same fake code from catching other people. Be careful afterwards, too: scammers sometimes follow up pretending to be your bank or a “recovery service” that can get your money back for a fee. Real banks and government agencies will not ask for that.
Quick checklist
| Situation | Safe move |
|---|---|
| QR code sticker on a parking meter | Pay at the machine or in the parking app you already have |
| QR code in an unexpected email or text | Do not scan; go to the company’s site yourself |
| Letter or bill with a QR code to pay | Verify with the organization using contact details you look up |
| Restaurant menu code | Generally fine; do not enter card details unless you trust the page |
| You already entered details | Bank first, then passwords, then report |
For more ways to protect yourself, browse our security guides.
Frequently asked questions
Can scanning a QR code hack my phone?
Scanning a code on its own just opens a link, and on an up-to-date phone that rarely causes harm by itself. The danger is what comes next: a fake page asking for your details, or a prompt to download an app or file.
What is quishing?
Quishing is phishing done with a QR code. Instead of a clickable link, the scam message contains a QR code that leads to a fake login or payment page.
How can I tell if a parking meter QR code is fake?
Look for a sticker placed over the original code or a sign that looks altered, and check that the web address belongs to the city or the parking company. When in doubt, pay with coins or a card at the meter, or use the parking app you already trust.
I scanned a QR code and entered my card number. What should I do?
Contact your card issuer right away using the number on the back of your card or in its official app, and ask them to block the card. Then watch your statements and report the scam.
Do I need a QR code scanner app?
No. The camera apps on current iPhones and most Android phones read QR codes and show the link first. Extra scanner apps from unknown developers can be full of ads or worse.
Where do I report a QR code scam?
In the United States, report it at reportfraud.ftc.gov. In Canada, report it to the Canadian Anti-Fraud Centre and your local police.
Sources
Free Tech Support Editorial Team
Editorial team
The Free Tech Support editors write and update these guides from the official documentation of Microsoft, Apple, Google and device makers. We are an independent site with no phone line and no paid support service.
