QR Code Scams
QR codes are everywhere: menus, parking meters, EV chargers, packages and job flyers. Scammers paste fake codes over real ones or send them by email and mail, taking you to look-alike sites that steal card numbers and passwords, or to malicious apps.
- Everyone
Photo: QR code sticker pasted over the original code on a parking pay station
Where fake QR codes show up
- Stickers on parking meters, pay stations and EV chargers
- Emails claiming a package problem, account lock or required “security update”
- Unexpected letters or packages with a code to scan
- Flyers for jobs, rentals or giveaways
- Fake parking tickets left on windshields
Before you scan
- Look at the code: is it a sticker on top of another code, or does it look tampered with?
- Preview the link your phone shows before opening it. Check that it’s the real company’s website, spelled correctly.
- Type the address yourself or use the company’s official app for payments.
- Don’t scan codes in unexpected emails, texts or mail asking you to log in or pay.
- Don’t download apps from QR code links; use your phone’s official app store.
Urgency is a red flag. “Your account will be locked,” “pay now to avoid a fine” and “your package is held” are scam tactics, whether they arrive as a link or a QR code. See Phishing Emails.
If you scanned a bad code
- Don’t enter any more information; close the page.
- If you entered card details, call your bank or card company right away.
- If you entered a password, change it, and turn on two-factor authentication. See Two-Factor Authentication.
- Report the fake code to the business or city that owns the meter or charger, and to the FTC. See Reporting Cybercrime.
Standards & references
Last updated: