QR codes make everyday tasks easier, from paying bills and viewing restaurant menus to accessing websites and tracking deliveries. However, scammers also use them to hide malicious links and make fraudulent requests appear legitimate.
A fake QR code can lead to a phishing website that imitates a bank, courier service, or payment provider. Other scams redirect payments to a criminal's account or encourage users to download harmful software.
This guide explains how QR code scams work, how to recognize common warning signs, and what to do if you scan a suspicious code.
What Are QR Code Scams?
QR code scams are fraudulent schemes in which criminals use fake, altered, or misleading QR codes to trick people into visiting malicious websites, sharing sensitive information, or sending money to the wrong recipient.
These scams appear on parking meters, restaurant menus, posters, payment notices, emails, and text messages. Criminals may replace a legitimate QR code with a sticker containing a different link or send a code with a message about an unpaid bill, missed delivery, or account problem.
The destination often imitates a legitimate website. When users enter their login credentials, banking information, or card details, scammers can use that information to commit fraud or gain unauthorized account access.
QR code phishing, also known as quishing, is a growing cybersecurity concern. According to Kaspersky, detections of phishing emails containing malicious QR codes increased from 46,969 in August 2025 to 249,723 in November 2025. This represents an increase of more than five times in three months. These figures describe detected phishing emails, not the total number of QR code scams or victims.
How Do QR Code Scams Work?
QR code scams typically follow four steps: creating a malicious code, persuading someone to scan it, directing them to a fraudulent destination, and exploiting their actions.
1. Scammers Create a Malicious QR Code
Scammers generate a QR code that contains a link to a phishing website, a fraudulent payment page, or another unwanted destination. They may design the destination to resemble a bank, courier service, online store, or payment provider.
The QR code itself usually looks ordinary. Its appearance does not reveal whether the encoded link is trustworthy.
2. Scammers Distribute or Replace the Code
Criminals place malicious QR codes where people expect to find legitimate ones. They may cover a real code on a parking meter with a sticker or print a fraudulent code on a flyer.
They also send QR codes through emails, text messages, social media posts, and PDF attachments. The accompanying message may claim that a package needs redelivery, a bill is overdue, or an account requires immediate verification.
These messages create urgency to encourage people to scan the code without checking the request.
3. The QR Code Opens a Fraudulent Destination
When someone scans the code, their phone displays the encoded information, often a website URL. If they open the link, it may lead to a fake website that copies the design of a legitimate service.
The website may ask the user to sign in, confirm personal details, pay a fee, or enter card information. A convincing design and familiar logo can make the fraudulent page difficult to distinguish from the real one.
4. Scammers Steal Information or Money
The scam succeeds when a victim takes an action that benefits the criminal. Scammers may steal entered passwords, use card details for unauthorized transactions, or divert payments to themselves instead of the intended recipient.
Some scams also encourage users to download harmful files, install untrusted applications, or grant unnecessary permissions.
Scanning a QR code alone does not automatically mean your device has been compromised. The risk depends on the destination and what happens next. Opening a malicious link, submitting sensitive information, downloading a file, or granting permissions can increase the risk.
What Are the Common Types of QR Code Scams?
QR code scams use different methods to steal information, redirect payments, or expose devices to security threats.
1. QR Code Phishing (Quishing)
Quishing is a form of phishing in which scammers use QR codes to direct victims to fraudulent websites. These codes may appear in emails, text messages, posters, or documents.
For example, an email may contain a QR code that supposedly verifies a Microsoft account. Scanning it opens a fake login page that collects the user's email address and password.
Warning sign: An unexpected QR code asks you to sign in, verify your identity, or resolve an urgent account problem.
2. Fake Payment QR Codes
In payment scams, criminals replace legitimate QR codes with codes linked to their own payment accounts or fraudulent payment pages.
These scams can occur at parking meters, shops, restaurants, and other places where QR codes are used to collect payments. A victim may complete the transaction without realizing that the money is going to the wrong recipient.
Warning sign: A payment code appears on a sticker, redirects to an unfamiliar payment service, or displays recipient details that do not match the intended business.
3. Delivery and Parcel Scams
Scammers send messages claiming that a parcel could not be delivered, a shipping fee remains unpaid, or an address needs verification. The message includes a QR code that supposedly resolves the issue.
The code may lead to a fake courier website that requests personal details or a small payment. Criminals can use the information to commit further fraud.
Warning sign: An unexpected delivery message asks you to scan a code or pay a fee before providing verifiable shipment details.
4. Malware and Unsafe Download Scams
Some QR codes direct users to websites that promote malicious downloads or untrusted applications. Depending on the device, browser, and security settings, following these instructions can expose the user to malware.
The downloaded software may attempt to access sensitive data, monitor activity, or perform other harmful actions.
Warning sign: A QR code directs you to download an unfamiliar application, install a file from an untrusted source, or change your device's security settings.
5. Fake QR Codes in Public Places
Scammers may place fraudulent stickers over genuine QR codes on parking meters, restaurant tables, posters, or public notices.
Because users expect these codes to be legitimate, they may scan them without questioning the destination. The replacement code may redirect them to a phishing page or fraudulent payment service.
Warning sign: A QR code sticker looks damaged, covers another code, or appears inconsistent with the surrounding sign.
How Can You Avoid QR Code Scams?
Follow these precautions before scanning a QR code or opening its destination.
1. Inspect the QR Code and Its Source
Check where the code came from before scanning it. Be cautious with unexpected codes in emails, text messages, social media posts, and public places.
Look for stickers covering existing codes, damaged labels, unfamiliar branding, or messages that pressure you to act immediately. When a code appears on a restaurant menu or parking meter, ask an employee or verify the payment method through the business's official website or app.
2. Check the URL Before Opening It
Preview the destination URL after scanning the code. Look for misspellings, extra words, unfamiliar domain names, and misleading subdomains.
For example, a website that uses a brand name in an unfamiliar domain is not necessarily operated by that brand. A padlock icon or HTTPS connection also does not prove that a website is legitimate.
Use an online QR code scanner to decode a QR code and view its embedded URL before opening it. If the destination looks unfamiliar or suspicious, do not visit it.
3. Verify Payment Details Independently
Before paying through a QR code, confirm the recipient's name, account details, and payment amount. Use the official payment application or contact the business through a trusted channel if anything looks unusual.
Do not assume that a QR code is genuine simply because it appears on an official-looking sign.
4. Avoid Unexpected QR Codes in Messages
Treat QR codes in unexpected emails and text messages with the same caution as suspicious links.
If a message claims that your account is blocked, a package is delayed, or a payment is overdue, visit the organization's official website or app directly. Do not use the QR code to resolve an issue until you have independently verified the request.
5. Protect Your Accounts and Devices
Keep your phone's operating system, browser, and applications updated. Use strong, unique passwords and enable multifactor authentication for important accounts.
Download applications only from trusted sources, and review requests for permissions before approving them. A security application can provide an additional layer of protection, but it cannot guarantee that every malicious link will be blocked.
6. Monitor Your Financial and Online Accounts
Review bank transactions, payment notifications, and account sign-in activity regularly. Investigate unfamiliar transactions or login attempts promptly.
If you notice suspicious activity, change the affected passwords through official websites or apps and contact the relevant service provider.
What Should You Do If You Scan a Fake QR Code?
Your next steps depend on whether you simply scanned the code, opened the website, shared information, made a payment, or downloaded a file.
If You Scanned the Code but Did Not Open the Link
If your camera only displayed the URL and you did not open it, enter information, or download anything, the risk is generally low.
Dismiss the preview and avoid opening the destination. No further action is usually necessary unless your device shows other signs of suspicious activity.
If You Opened a Suspicious Website
Close the page and do not enter personal information or download files. Check your device for unfamiliar downloads and avoid granting permissions requested by the website.
Opening a suspicious page does not automatically mean your information has been stolen. However, if you notice unusual device behavior or suspect an exploit, update your device and seek help from a trusted security professional.
If You Entered Your Password
Change the compromised password immediately through the service's official website or app. If you reused that password on other accounts, change those passwords too.
Enable multifactor authentication, review recent sign-ins, and sign out of unfamiliar sessions. Contact the service provider if you suspect that someone has accessed your account.
If You Shared Banking or Card Details
Contact your bank or card issuer using its official phone number or application. Explain what happened and ask whether you need to freeze your card, block transactions, or request a replacement.
Review recent transactions and report unauthorized payments promptly. If you transferred money to a scammer, contact your bank or payment provider immediately to ask whether the transaction can be stopped or recovered.
If You Downloaded a Suspicious File or Application
Do not open the file or continue using the suspicious application. If you installed an unfamiliar app, remove it when safe to do so and run a security scan using a trusted tool.
Review the permissions granted to the application. If you suspect that the device is compromised, use another trusted device to change important passwords and seek professional assistance.
Conclusion
QR code scams exploit the convenience of scanning a code to direct people to phishing websites, fraudulent payment pages, and potentially harmful downloads. Scammers often disguise these codes as legitimate delivery notices, public payment options, or account verification requests.
Check the destination URL before opening a QR code link, verify payment details independently, and never enter sensitive information on an untrusted website. If you receive an unfamiliar QR code, use an online QR code scanner to inspect its embedded information before deciding whether to visit the destination.