SCAM AWARENESSQR code scams
QR code scams use those square barcodes to send you to a fake website. Scammers place their own codes on parking meters, flyers, or signs, or send them in emails, texts, and mailed letters. The fake site may ask you to pay, log in, or share personal details, or it may try to get you to download a harmful app.
How this scam works
A QR code hides its web address until you scan it, so it is easy to swap one for another. Scammers stick a fake code over a real one on a parking pay station, restaurant table, or public notice. Others send emails, texts, or letters saying you must scan a code to fix a payment or secure your account.
After you scan, your phone opens a site that looks real, such as a parking payment page or a bank login. You enter your card number or password, and the scammer captures it. Some pages ask you to download an app or sign up for a recurring charge. You may not notice anything is wrong until you get a parking ticket or see strange charges.
What it can look like
EXAMPLE · NOT A REAL MESSAGESticker on a parking pay station: "New contactless payment! Scan to pay for parking. Coins and cards no longer accepted at this meter." The code opens a page at [link] asking for your card number, expiration date, and security code.
Warning signs
- A QR code sticker placed over another code or on top of signage
- A code that sends you to a website address that does not match the business
- An unexpected email, text, or letter asking you to scan a code to fix a problem
- Pressure to act fast to avoid a fine, lockout, or missed delivery
- The page asks for a password or full card details for a small task
- The code prompts you to download an app from outside your phone's app store
How to protect yourself
- Look closely at QR codes in public places and do not scan ones that look tampered with or stuck on.
- Before tapping, check that the previewed web address matches the real business.
- Pay for parking and bills using the official app or the address printed on official signs or statements.
- Do not scan codes in unexpected emails, texts, or mail that pressure you to act.
- Only download apps from your phone's official app store.
If you already responded
- If you entered card details, call the number on the back of your card and report possible fraud.
- If you entered a password, change it right away, everywhere you used it.
- Turn on two-step verification for accounts that may be affected.
- If you downloaded an app, delete it and run your phone's security check or update.
- Report the scam to the FTC, and to the FBI's IC3 if you lost money online.
Get step-by-step recovery help →
Where to report it
Common questions
Can scanning a QR code hack my phone?
Scanning a code mainly opens a web address, so the bigger danger is what you do next: entering passwords or card numbers, or installing an app. Check the address before opening it, keep your phone updated, and avoid downloading anything a code tells you to.
How do I know if a parking meter QR code is real?
Look for tampering, like a sticker placed over another code. Compare the web address to the city's or parking company's official site. When in doubt, use the official parking app or another payment method listed on official signs.
Is it safe to scan QR codes on restaurant menus?
Usually, if the code leads to a menu. Be cautious if it asks for payment, a login, or app downloads you did not expect. Check the web address matches the restaurant, and if anything seems odd, ask staff whether the code is theirs or request a paper menu.