# QR code scams: check before you scan

> Fake QR stickers on parking meters and QR codes in texts or emails lead to look-alike sites or malware. How to read the link first, and what to do if you paid.

- Canonical URL: https://threatvetting.com/qr-code-scams/
- Source: [FTC Consumer Alert, Scammers hide harmful links in QR codes](https://consumer.ftc.gov/consumer-alerts/2023/12/scammers-hide-harmful-links-qr-codes-steal-your-information)
- Checked: 2026-10-26
- Structured data: https://threatvetting.com/data/qr-code-scams.json

## Where fake codes turn up
The FTC describes two patterns ([FTC](https://consumer.ftc.gov/consumer-alerts/2023/12/scammers-hide-harmful-links-qr-codes-steal-your-information)):

- **Stickers on real things.** Reports of scammers covering the QR codes on parking meters with their own.
- **Codes sent to you.** A text or email with a made-up reason to scan: a failed delivery, a problem with your account, or "suspicious activity" that needs a password change.

Either way, the code opens a look-alike site that collects what you type, or it can install malware that steals information before you notice.

## A QR code is just a hidden link
You cannot read a QR code with your eyes, which is exactly why it suits scammers. The fix is to turn it back into a link you can read:

1. Point the camera at it but **do not tap the banner yet**. If your camera shows the address before opening it, read that first; the FTC's advice is to inspect the URL before you open it ([FTC](https://consumer.ftc.gov/consumer-alerts/2023/12/scammers-hide-harmful-links-qr-codes-steal-your-information)).
2. **Read the domain**: the name just before the first single slash. Look for misspellings or swapped letters, which the FTC warns about ([FTC](https://consumer.ftc.gov/consumer-alerts/2023/12/scammers-hide-harmful-links-qr-codes-steal-your-information)).
3. Not sure? **Copy the address** and paste it into our [link checker](https://threatvetting.com/). It reads the link as text and flags shorteners, look-alike letters and brand names in the wrong place.

## Quick rules by place
| Where you see it | What to do |
|---|---|
| Parking meter, poster, restaurant table | Check for a sticker over the original; read the address before opening ([FTC](https://consumer.ftc.gov/consumer-alerts/2023/12/scammers-hide-harmful-links-qr-codes-steal-your-information)) |
| Email or text, especially urgent | Do not scan; contact the company using a number or website you know is real ([FTC](https://consumer.ftc.gov/consumer-alerts/2023/12/scammers-hide-harmful-links-qr-codes-steal-your-information)) |
| A letter or parcel note | Type the company's address yourself instead |

For parking, the same rule applies: pay through a website or app you already know belongs to the operator, typed or installed by you, rather than whatever the sticker opens.

## Protect the phone you scan with
- **Keep the operating system updated**, which the FTC names as protection against hackers ([FTC](https://consumer.ftc.gov/consumer-alerts/2023/12/scammers-hide-harmful-links-qr-codes-steal-your-information)).
- **Use strong passwords and multi-factor authentication** on your accounts, so a stolen password alone is not enough ([FTC](https://consumer.ftc.gov/consumer-alerts/2023/12/scammers-hide-harmful-links-qr-codes-steal-your-information)).

## Already scanned and paid?
Call your card issuer on the number on the back of the card and ask for the charge to be reversed ([FTC](https://consumer.ftc.gov/articles/what-do-if-you-were-scammed)). If you typed a password, change it from the real site. Then report: in the US at ReportFraud.ftc.gov ([FTC](https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams)); in the UK through Report Fraud or Police Scotland ([NCSC](https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-text-message)). Step by step: [gave a scammer your details or money](https://threatvetting.com/gave-my-details-to-a-scammer/).

Left out of this page: QR codes used for payments inside banking apps, which follow your bank's own rules.

---
Threat Vetting · Contact: contact@threatvetting.com