How QR Code Scams Work and How to Stay Safe in 2026

QR codes are everywhere: menus, parking meters, posters and letters. That makes them a handy tool for scammers, sometimes called "quishing." A QR code hides the web address it points to, so it's easy to send someone to a fake site without them noticing.

Common QR code scams

• Fake parking stickers: scammers stick their own codes over real ones on parking meters and pay stations, leading to fake payment pages. Several US cities have warned about this.
• Phishing emails: an email says your account needs attention and asks you to scan a code. Codes in images can slip past email filters.
• Fake delivery notices: a letter or text with a code to "reschedule a delivery" or pay a small fee.
• Unexpected parcels: packages you didn't order with a code to "find out who sent it."
• Restaurant and poster swaps: stickers over legitimate codes.

The US Federal Trade Commission warned consumers about QR code scams in December 2023.

Warning signs

• A sticker placed over another code, or one that looks out of place.
• Urgency: "pay now to avoid a fine."
• A code in an email or text asking you to sign in or pay.
• A web address in the preview that doesn't match the company.

How to check a code before opening it

1. Most phone cameras show the web address before opening it. Read it carefully.
2. Check the spelling of the site name. See typosquatting.
3. Look for a short-link service hiding the real address.
4. For payments, use the official app or type the company's web address yourself.

What scammers want

Usually card details, a sign-in, or to get you to download an app. Never install an app from a QR code you weren't expecting.

If you've been caught

1. Call your bank and cancel your card if you entered details.
2. Change the password for any account you signed in to, and turn on two-factor authentication.
3. Report it to the business whose code was covered, and to the FTC at ReportFraud.ftc.gov in the US.

Protect your clipboard too

Scam pages sometimes try to read what you've copied, such as a password or a sign-in code. Clipboard Guard blocks websites in Chrome from reading your clipboard. It doesn't scan QR codes. See spotting fake websites.