Threat Vetting

QR code scams: check before you scan

Fake QR stickers on parking meters and QR codes in texts or emails lead to look-alike sites or malware. How to read the link first, and what to do if you paid.

2 min — Due for review by 2026-11-25

Where fake codes turn up

The FTC describes two patterns (FTC):

  • Stickers on real things. Reports of scammers covering the QR codes on parking meters with their own.
  • Codes sent to you. A text or email with a made-up reason to scan: a failed delivery, a problem with your account, or "suspicious activity" that needs a password change.

Either way, the code opens a look-alike site that collects what you type, or it can install malware that steals information before you notice.

You cannot read a QR code with your eyes, which is exactly why it suits scammers. The fix is to turn it back into a link you can read:

  1. Point the camera at it but do not tap the banner yet. If your camera shows the address before opening it, read that first; the FTC's advice is to inspect the URL before you open it (FTC).
  2. Read the domain: the name just before the first single slash. Look for misspellings or swapped letters, which the FTC warns about (FTC).
  3. Not sure? Copy the address and paste it into our link checker. It reads the link as text and flags shorteners, look-alike letters and brand names in the wrong place.

Quick rules by place

Where you see it What to do
Parking meter, poster, restaurant table Check for a sticker over the original; read the address before opening (FTC)
Email or text, especially urgent Do not scan; contact the company using a number or website you know is real (FTC)
A letter or parcel note Type the company's address yourself instead

For parking, the same rule applies: pay through a website or app you already know belongs to the operator, typed or installed by you, rather than whatever the sticker opens.

Protect the phone you scan with

  • Keep the operating system updated, which the FTC names as protection against hackers (FTC).
  • Use strong passwords and multi-factor authentication on your accounts, so a stolen password alone is not enough (FTC).

Already scanned and paid?

Call your card issuer on the number on the back of the card and ask for the charge to be reversed (FTC). If you typed a password, change it from the real site. Then report: in the US at ReportFraud.ftc.gov (FTC); in the UK through Report Fraud or Police Scotland (NCSC). Step by step: gave a scammer your details or money.

Left out of this page: QR codes used for payments inside banking apps, which follow your bank's own rules.