Fake QR code scams: how to spot a bad code
Quick answer
A fake QR code hides a link to a spoofed website or malware. Scammers stick codes over real ones, such as on parking meters, or send them by text or email. Check the web address before you open it, and never scan a code in a message you didn't expect.
- Last updated
How it works
A QR code is only a link you can't read. The FTC says scammers hide harmful links in them to steal personal information.
The FTC reports that scammers have covered the QR codes on parking meters with their own. Others send a QR code by text or email with an invented reason to scan it: they couldn't deliver your package, there is a problem with your account, or they noticed suspicious activity and you must change your password.
Those stories create urgency so you open the address without thinking. The code can take you to a fake site that looks real and collects whatever you type, or install malware that steals your information.
Red flags
- A QR code in an unexpected place, or stuck over another one
- A QR code in a text or email you weren't expecting
- A story about a missed delivery, account problem or suspicious activity
- A web address with a misspelling or a switched letter
- Pressure to act right now
Example message
A delivery attempt for your parcel failed because no one was home. Scan the attached QR code to reschedule delivery today, or the parcel will be returned.
What to do
- 1
Look at the address before you open it
If you scan a code in an unexpected place, inspect the URL first. Check for misspellings or a switched letter.
- 2
Don't scan codes in messages you didn't expect
If you think the message could be real, contact the company using a phone number or website you know is real.
- 3
Check physical codes
On a parking meter or sign, look for a sticker placed over another code, and use the official app or website to pay instead.
- 4
If you signed in or paid on a page
Change that password right away, and ask your card issuer to watch or replace the card. See what to do after a data breach for the steps.
- 5
Protect your phone and accounts
Update your phone's operating system and turn on multi-factor authentication.
- 6
Report it
Report the scam to the FTC. If it came by text, forward it to 7726 (SPAM).
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
A QR scam text only works if it matches something real in your life, such as a parcel you are waiting for. Scammers pick phone numbers and emails from data breaches and people-search sites. Serus finds the data brokers and people-search sites that list your name, address and phone number and sends the removal requests, and it alerts you when your details show up in a breach, so fewer scammers can reach you.
Frequently asked
Can scanning a QR code hack my phone?
The FTC says a QR code can take you to a spoofed site that steals what you enter, or install malware that steals your information.
How can I tell if a QR code was tampered with?
Look for a sticker stuck over the original, and check the web address the code opens before you go on.
Is it safe to scan QR codes at restaurants or events?
Check the address that appears before you enter any details. If the address looks wrong, don't continue.
Where do I report a QR code scam?
Report it to the FTC at ReportFraud.ftc.gov.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
