How to help protect yourself from QR code scams

QR (Quick Response) codes have become a convenient way to access websites, make payments, view restaurant menus, join Wi-Fi networks, and receive information using a mobile device. Unfortunately, fraudsters are increasingly using QR codes to trick people into visiting fake websites, downloading malware, or sharing sensitive information.

According to one recent study, QR code phishing attacks increased more than fivefold in the second half of 2025. Because QR codes hide the web address until they are scanned, it can be difficult to tell whether they are safe or malicious.

What are QR code scams?

A QR code is a square barcode that can be scanned by a smartphone camera to open a website, app, or other digital content. QR code scams occur when fraudsters use malicious QR codes to direct people to fraudulent websites or other harmful content.

A scam may start with a QR code sent by email, text message, or direct mail. Fraudsters may also place fake QR codes in public spaces or on top of legitimate QR codes. Once scanned, the code may direct you to a fake website designed to steal personal, financial, or login information.

Example: You receive an unexpected email that appears to be from a company you trust, warning that your account will be suspended unless you scan a QR code and verify your information. You scan the code and it opens a website that looks legitimate, so you enter your username and password. Unfortunately, the site is fake and the login information you entered has gone directly to fraudsters.

Types of QR code scams

Email phishing campaigns

Fraudsters may send emails, letters, or invoices containing QR codes and claim that immediate action is required to pay a bill, verify account information, or update security settings.

Some attacks use dynamic QR codes, which can be updated to direct users to a different website after a phishing email has been delivered. Even if the original link does not appear suspicious, the QR code can later redirect users to a convincing fraudulent website designed to capture login credentials, payment card information, banking details or other sensitive information.

Because people often scan QR codes using a mobile device, these scams can be harder to identify than traditional phishing attempts.

Parking payment scams

Fraudsters place fake QR codes on parking meters, pay stations, or signage. When scanned, the QR code directs users to a fraudulent payment website designed to collect payment card information or personal details.

Instead of paying for parking, victims unknowingly provide their financial information directly to a scammer.

Restaurant menu scams

Many restaurants now use QR codes instead of printed menus. Fraudsters may replace or cover legitimate QR codes with fake ones that direct customers to malicious websites.

These websites may prompt users to download software, enter payment information, or provide personal details under the guise of accessing a menu or placing an order.

Event and public venue scams

Fraudsters may place fake QR-code stickers over legitimate QR codes at events, public venues, or promotional materials.

Victims may believe they are accessing event information, purchasing tickets, or registering for services, when they are actually being redirected to a fraudulent website designed to steal personal or financial information.

Traffic ticket payment scams

Fraudsters may send fake traffic ticket notices containing QR codes that direct victims to fraudulent payment websites.

These scams often create a sense of urgency by claiming immediate payment is required to avoid penalties or additional fees. Victims who scan the code may unknowingly provide payment card information or personal details directly to a scammer.

Rideshare payment scams

Fraudsters may display fake QR codes inside rideshare vehicles and claim they are required for payment. When scanned, the QR code redirects victims to a fraudulent payment page that captures payment card information or other sensitive data.

Red flags to watch out for

• QR codes received unexpectedly through email, text message, direct mail, or social media.
• QR codes accompanied by urgent requests, warnings or threats that an account or service will be suspended.
• Websites that ask for passwords, banking information, payment card details, or other sensitive information.
• Requests to download apps or software after scanning a QR code.
• QR codes found in public locations where they could have been tampered with. Look for signs of stickers or labels placed over existing QR codes.
• Messages containing spelling or grammar errors, unfamiliar branding or unusual requests.

Tips to help protect yourself

• Verify that a QR code comes from a trusted source before scanning it.
• Be cautious when scanning QR codes displayed in public places.
• Review the website address before entering any personal or financial information.
• If possible, configure your mobile device to preview URLs before opening them.
• Avoid scanning QR codes that appear altered, covered, or suspicious.
• Whenever possible, type the website address directly into your browser instead of scanning a QR code.
• Never provide usernames, passwords, banking information, or payment card details on a website you were directed to through an unexpected QR code.

The bottom line

QR codes can be a convenient tool, but they can also be used by fraudsters to hide malicious links and trick people into sharing sensitive information. As QR code use continues to grow, it's important to pause and think before you scan. A few extra seconds spent verifying a QR code, reviewing the destination website, or navigating directly to a trusted site can help protect you from becoming the victim of a QR code scam.