QR Code Scams: Common Types and How to Avoid Them [2026]
Not Sure About a Code? Check It First
Before you tap through, preview where a QR code actually leads. Our free safety checker inspects the destination so you can spot suspicious links and reduce your risk.
Not sure about a code? Check it →QR code scams are rising fast. They are a form of quishing (QR phishing), where fraudsters use a QR code to send you to a fake website, trick you into paying money, or steal your login and payment details. Because the destination is hidden inside the code, you often cannot tell where it leads until it is too late. Here are the most common QR code scam types in 2025-2026 and how to avoid them.
Common QR Code Scam Types in 2025-2026
Scammers keep finding new places to plant malicious codes. These are the QR code scams security agencies and police departments are warning about right now.
Parking Meter and Parking Lot Sticker Scams
How it works: Fraudsters print fake QR code stickers and place them over the real code on parking meters, pay stations, and lot signs. Scanning the sticker sends you to a lookalike payment page that harvests your card details instead of paying for parking.
Red flags: A sticker sitting on top of another label, a payment site whose domain does not match the city or parking operator, or a page that asks for far more information than a quick parking payment should need.
Fake USPS and Package Redelivery Scams
How it works: You get a text or email claiming a package could not be delivered, with a QR code to "reschedule" delivery or pay a small fee. The code leads to a fake carrier site that steals your address, card number, and login.
Red flags: An unsolicited delivery notice for a package you were not expecting, a small "redelivery fee" request (real carriers rarely charge this by text), and a domain that is not the carrier's official website.
Toll and Traffic-Violation Text Scams
How it works: A text warns of an unpaid toll or traffic violation and pressures you to scan a QR code to "pay now to avoid court" or extra fines. The code opens a fake toll-agency page built to capture your payment details.
Red flags: Threats of legal action or ballooning penalties, urgent deadlines, and a payment link that does not match your state or toll authority.
Fake Payment and Donation QR Codes
How it works: Scammers swap the QR code on invoices, tip jars, charity flyers, or in-store signs with one that routes your money to their own account. You think you are paying a business or donating to a cause, but the funds go to the fraudster.
Red flags: A payment code that shows an unfamiliar recipient name, a taped-on or printed code that looks newer than the sign around it, and any pressure to send money quickly.
Restaurant Menu QR Swaps
How it works: A scammer covers the restaurant's menu QR code with their own sticker. Instead of the menu, you land on a phishing page that asks you to "log in" or enter payment details to view the menu or order.
Red flags: A menu code that asks you to log in or pay before showing anything, a domain unrelated to the restaurant, and a sticker layered over the table's original code.
Crypto and "Verify Your Account" QR Scams
How it works: You receive a message urging you to scan a code to "verify" or "secure" a crypto wallet, bank, or exchange account. The code opens a fake login that captures your credentials or a wallet-connect prompt that drains your funds.
Red flags: Unexpected "account verification" requests, promises of rewards or refunds, and any prompt to connect a wallet or enter a recovery phrase after scanning.
Email QR Codes (Fake MFA and Document Lures)
How it works: An email embeds a QR code and asks you to scan it to complete multi-factor authentication, review a shared document, or reset a password. Because the malicious link is inside an image, these codes often slip past email security filters that would normally flag a bad URL.
Red flags: Any email that pushes you to scan a code with your phone to log in or "re-verify," unexpected document-share notices, and messages that route you off your computer and onto your phone to avoid corporate protections.
Create a QR Code You Control
Making codes for your business, event, or menu? Generate them yourself so customers scan a code you trust, instead of a sticker anyone could tamper with.
Create a QR code you control →QR Code Scam Red Flags Checklist
Most QR code scams share the same warning signs. Pause if you notice any of these:
- Urgency or threats: Deadlines, fines, or "act now" pressure designed to stop you thinking.
- Payment requested: A code that immediately asks you to pay a fee or fine, especially an unexpected one.
- Credentials requested: Prompts to log in, verify an account, or enter a password or recovery phrase after scanning.
- Mismatched domain: The web address does not match the real company, city, or carrier it claims to be.
- Sticker over a code: A QR code that looks layered, taped on, or newer than the sign around it.
- Unsolicited code: A QR code that arrives out of the blue by text, email, or on a flyer you did not request.
Want a deeper look at when scanning is and is not risky? See our guide on whether QR codes are safe.
What to Do If You Scanned a Scam QR Code
If you scanned a code and something feels off, act quickly. These steps help limit the damage:
- Do not enter any information. Do not type passwords, card numbers, or personal details into the page, and do not download anything it prompts.
- Close the page immediately. Exit the browser tab and, if it opened an app or prompt, dismiss it without granting permissions.
- Change your passwords if you entered them. If you typed a password, change it right away on the real site and turn on two-factor authentication. Update any other account that shares that password.
- Contact your bank if you shared payment details. Call your bank or card issuer, report the fraud, and ask about freezing the card or reversing charges.
- Watch your accounts. Monitor your bank, card, and email accounts for unusual activity over the following weeks.
- Report it. File a report with the FTC at reportfraud.ftc.gov. For fake USPS or package texts, report to the U.S. Postal Inspection Service (USPIS). Reporting helps warn others and shut scams down.
Frequently Asked Questions
What is a QR code scam?
A QR code scam is a form of quishing (QR phishing) where scammers use a QR code to send you to a fake website, trick you into paying money, or steal your login and payment details. The code often looks legitimate but points to a fraudulent destination.
How do QR code scams work?
Scammers place or send a malicious QR code, often disguised as a parking sign, package notice, invoice, or menu. When you scan it, you land on a lookalike site that asks for payment, passwords, or personal information, or that quietly installs malware. Because the destination is hidden inside the code, it is hard to tell where you are going before you scan.
What should I do if I scanned a scam QR code?
Do not enter any information. Close the page immediately and do not download anything it prompts. If you already entered a password, change it right away and enable two-factor authentication. If you entered payment details, contact your bank or card issuer. Watch your accounts for unusual activity and report the scam to the FTC at reportfraud.ftc.gov (and the U.S. Postal Inspection Service for fake USPS texts).
How can I avoid QR code scams?
Be skeptical of QR codes that arrive unsolicited by text or email, or that ask for payment or login details. Check the preview URL before opening it, look for stickers placed over an original code, and type known web addresses directly instead of scanning. A safety checker can help you preview and inspect a code's destination to reduce your risk, though no check can make scanning completely safe.
Are QR code parking scams real?
Yes. Fraudsters place fake QR code stickers over legitimate ones on parking meters, pay stations, and parking-lot signs. Scanning the sticker leads to a fake payment page that steals your card details. Cities and police departments across the US and UK have issued warnings about these parking QR scams.
Check a Code Before You Trust It
QR code scams work because the destination is hidden. Preview and inspect a code's link with our free safety checker, or generate a QR code you control for your own business or event.
Related Pages
What Is Quishing? QR Code Phishing Explained
The complete guide to quishing (QR phishing): how it works, why it bypasses defenses, and how to stay safe.
Are QR Codes Safe?
When QR codes are safe to scan, when they are not, and the simple habits that reduce your risk.
QR Code Safety Checker
Preview and inspect where a QR code leads before you open it, so you can spot suspicious links.