QR Code Scams: How to Scan Safely and What to Do if You Slipped
QR codes are those small black-and-white squares you scan with your phone camera. You see them on restaurant menus, parking meters and packages. They are handy. Scammers have also found ways to use them, because a QR code hides the web address behind it. You cannot tell where it leads until you scan it.
This guide explains how QR code scams work, what to look for and what to do if you scanned a bad one. If it has happened to you, you are not alone, and there is no shame in it.
How QR Code Scams Work
The Federal Trade Commission (FTC) describes two common tricks.
- A sticker placed over a real code. Scammers cover the QR code on something like a parking meter with their own. The new code leads to a fake website that tries to collect your payment or personal details.
- A code sent by text or email. The message gives a made-up reason, such as a package that could not be delivered, an account problem, or “suspicious activity” that needs a password change. Scanning the code may take you to a copycat site that captures your login. The FTC says it may also install malware, which is harmful software.
In September 2026, the FTC again warned about fake QR codes placed over real ones on parking meters.
Red Flags
- A QR code in an unexpected text or email, especially one that says to act right away.
- A code that looks like a sticker placed over another code.
- A web address that appears after scanning with a misspelling or a switched letter.
- A page that asks for your password, bank details or Social Security number.
How to Stay Safe
- Look at the web address first. Most phones show a preview of the link after you scan. Check it for misspellings or switched letters before you tap.
- Do not scan codes in unexpected messages. If a message says there is a problem with an account or delivery, contact the company using a phone number or website you already know is real.
- Check the code in person. If a code on a meter or sign looks like it was stuck on, do not scan it. Ask staff, or pay another way, such as at the machine or with the company’s official app typed in yourself.
- Keep your phone up to date. Install system and app updates.
- Use strong passwords and two-step verification. This adds protection if a password is ever stolen.
If You Already Scanned a Code
Scanning alone does not always cause harm, but be careful about what comes next. The FTC suggests these steps:
- Do not enter information or interact with the site any further.
- Change the password for any account where you used the same password, starting with email and banking.
- Look over your credit card and bank statements for charges you do not recognize, and call your bank or card company right away if you find any.
- Report it at ReportFraud.ftc.gov.
If you lost money, call the DOJ National Elder Fraud Hotline at 1-833-FRAUD-11 (1-833-372-8311). Our guide on what to do right away after paying a scammer walks through the next steps.
More on Seniors Tips
- Fake Package Delivery Texts: How to Spot Them and What to Do
- Paid a Scammer? What to Do Right Away
- Two-Step Verification Explained: A Simple Guide to Protecting Your Accounts
