QR Code Scams: How to Check a Link Before You Scan or Pay
QR codes make it easy to open a menu, pay for parking, join a Wi-Fi network, or sign into an account. They also hide the destination until someone scans them, which gives scammers an opportunity to redirect people to fake websites and payment pages.
A fraudulent QR code may be printed on a sticker placed over a legitimate code, included in an unexpected message, or attached to a package you never ordered. The safest response is to verify both the code’s source and the destination it displays before entering information or paying.
How QR Code Scams Work
A QR code can contain a website address, payment destination, contact information, or other data. A scammer can create one that sends users to:
A fake parking payment page
A copied bank or retailer login
A fraudulent package-tracking site
An unauthorized payment account
A malicious app download
A page requesting excessive phone permissions
A cryptocurrency wallet controlled by the scammer
The page may copy the colors, logo, and layout of a legitimate organization. It might also use urgent language claiming that an account will be closed, a package cannot be delivered, or a fine must be paid immediately.
Inspect the Physical QR Code
Before scanning a code in a public place, check whether it belongs there.
Look closely for:
A sticker placed over another code
Peeling corners or mismatched material
Printing that does not match the surrounding sign
Spelling or grammar errors
A code attached in an unusual location
Instructions that create urgency or threaten penalties
A request for an unexpected type of payment
Parking meters and payment signs deserve extra attention because scammers can cover a real code with a fraudulent sticker.
If the code looks altered, do not scan it. Use the parking provider’s official app, type its known website address manually, or follow another payment method printed on the meter. Report the suspicious sticker to the property owner or local parking authority.
Preview the Link Before Opening It
Most current phone cameras and QR scanners display a preview of the destination. Read that preview before tapping it.
Check for:
Misspelled company names
Switched or extra letters
Unfamiliar domain endings
Added words before or after the real brand name
Shortened links that hide the destination
A web address unrelated to the organization
Long strings of confusing characters
Focus on the main domain name. A scammer can place a familiar brand elsewhere in the address while using a different domain.
For example, a domain that contains a bank’s name followed by unfamiliar words is not necessarily owned by that bank. A padlock symbol or an address beginning with “https” only means the connection is encrypted. It does not prove the website is legitimate.
Some scanning apps open links automatically. If possible, change the setting so the destination is previewed first.
Use an Official Route Instead
When a QR code asks you to sign in, pay, update an account, or confirm personal information, avoid using the code as the starting point.
Instead:
Open the organization’s official app.
Type a known website address into the browser.
Use a phone number from a statement, card, or official sign.
Ask an employee to confirm the correct payment method.
Search your existing account for the bill or notification.
Do not rely on contact information displayed on the questionable page. It may connect you directly to the scammer.
Be Cautious With Codes in Messages and Packages
Treat an unexpected QR code in an email, text, social media message, or mailed package like any other suspicious link.
Common stories include:
A package delivery needs to be rescheduled.
An account has suspicious activity.
A password must be changed immediately.
A traffic ticket or toll must be paid.
A refund is waiting.
An unexpected package can be returned by scanning the code.
A prize or gift requires verification.
A workplace account needs urgent authentication.
Contact the organization independently if the claim could be legitimate. Do not let a deadline or threat prevent you from verifying it.
An unexpected package with no clear sender may also contain a QR code inviting you to discover who sent it. Do not scan it simply out of curiosity.
Check the Payment Details
A payment page should clearly identify the business, amount, and purpose of the transaction. Stop if the code sends payment to an individual you do not recognize or asks for an unusual method.
Be especially suspicious of instructions to pay through:
Cryptocurrency
Gift cards
A wire transfer
A payment app account belonging to an individual
Cash deposited into a cryptocurrency ATM
A payment method different from the one normally used by the organization
Government agencies, law enforcement departments, utilities, and legitimate businesses do not unexpectedly direct people to move money to a “safe” account or deposit cash into a cryptocurrency ATM using a supplied QR code.
Before approving a payment, verify the recipient inside the payment app. Some transfers are difficult or impossible to reverse once sent.
Do Not Install an App From an Unverified Code
A restaurant menu or parking payment should not normally require an unfamiliar app from outside the phone’s official app store.
Stop if a page asks you to:
Download an installation file
Change security settings
Allow device administration
Grant access to contacts or text messages
Share the screen
Install a remote-access tool
Enter a multifactor authentication code
If an app is genuinely required, locate it independently in the official app store and confirm that the developer name matches the organization.
Keep the phone’s operating system, browser, and security updates current. Updates can correct vulnerabilities that malicious websites may attempt to exploit.
What to Do if You Scanned a Suspicious Code
Scanning a code does not always mean your information has been stolen. The risk depends on whether you opened the destination, downloaded something, granted permissions, entered information, or made a payment.
If you only viewed the preview, close it without opening the link.
If you opened the page but entered nothing:
Close the browser tab.
Do not contact anyone through the page.
Check the device for unexpected downloads.
Update the phone and browser.
Remove unfamiliar apps or permissions.
If an app or file was installed, disconnect from sensitive accounts and consider obtaining help from a trusted technical professional.
If You Entered a Password
Go directly to the legitimate account and change the password immediately. Do not use the link from the QR code again.
Also:
Sign out of other active sessions.
Turn on multifactor authentication.
Change any other account using the same password.
Review recovery email addresses and phone numbers.
Check for unauthorized forwarding rules or security changes.
Watch for follow-up calls and messages.
Never provide a login verification code to someone who contacts you. A scammer may use the stolen password and then request the code needed to complete the account takeover.
If You Entered Payment Information or Sent Money
Contact the bank, card issuer, or payment service immediately using a verified number. Explain that the information or payment may have gone to a fraudulent website.
Ask whether the institution can:
Stop or reverse the payment
Replace the affected card
Block unauthorized transfers
Secure the account
Add additional monitoring
Explain the dispute process
Review statements for unfamiliar transactions. If sensitive personal information was disclosed, consider placing a credit freeze and monitoring all three credit reports.
Preserve screenshots, receipts, the QR code, the destination address, messages, packaging, and transaction details. Report the incident to the appropriate payment provider, local authority, and federal fraud-reporting agency.
Pause Before You Scan
The square image itself gives little information about who created it or where it leads. A familiar logo beside the code is not enough.
Inspect physical codes, preview the web address, and use an official app or manually entered website for payments and account access. A few seconds of verification can prevent a convenient shortcut from becoming an expensive problem.
