Short answer
A QR code is simply a link you can’t read. Scammers stick fake codes over real ones — the FTC mentions parking meters — or send them by email, text or letter with a pretext such as a failed delivery, an account problem or a required password change. The code opens a look-alike login or payment page, or a download. Before opening, check the web address your camera shows; don’t scan codes in messages you didn’t expect; and pay through the official app or website instead. If you entered a password, change it from a clean device and sign out other sessions; if you entered card details, call your bank.
Where fake QR codes show up
- Stickers placed over the real code on parking meters, chargers, restaurant tables or posters.
- Emails saying your account will be locked unless you “re-verify” by scanning — a code is harder for email filters to check than a link, and it moves you onto your phone.
- Texts and letters about a parcel, a fine or a refund.
- Fake “support” messages on social media asking you to scan a code to verify or unlock your account.
Check a code before you open it
- Read the web address preview before you tap. Look for misspellings or swapped letters that imitate a site you know — the FTC’s first tip.
- On a meter or poster, look for a sticker over the original code or other signs of tampering.
- Don’t scan a code in an email or text you weren’t expecting, especially one that pushes you to act now. Contact the company through a website or number you know is real.
- Prefer the official app or type the address yourself to pay or to sign in.
- Never enter a password or a two-step code on a page you reached through an unexpected code.
If you already scanned it
| What happened | Do this now |
|---|---|
| You only opened the page | Close it without entering anything, and keep your phone’s software updated |
| You entered a password | Change it from a clean device (email first), sign out other sessions and turn on 2FA |
| You entered card or bank details | Call your bank on the number on your card; block the card and dispute the payment |
| You installed an app or file | Uninstall it, update and scan the phone, then change passwords from another device |
| You gave a verification code | Assume the account is taken over and use the platform’s official recovery route |
Protect your phone and accounts
- Keep your phone’s operating system updated, as the FTC advises.
- Use strong passwords and multi-factor authentication — ideally a passkey, which can’t be typed into a fake page.
- A password manager won’t autofill on a look-alike site, which is itself a warning sign.
- Check where you are signed in after any slip: logged-in devices.
Report it
Tell the owner of the meter, car park or shop about the fake sticker, and report the message to your email provider or national reporting service — see how to report phishing. In the US, report fraud at ReportFraud.ftc.gov; for other countries, see where to report online fraud.
Frequently asked questions
Can scanning a QR code hack my phone?
Scanning only reads a link. The danger is what follows: entering details on a fake page or installing something. The FTC also warns that a code can lead to malware, so keep your phone updated and don’t install apps from links.
How can I tell if a QR code is fake?
Check the web address preview before opening it, look for stickers over the original code, and be suspicious of codes in unexpected emails or texts that push you to act fast.
What is quishing?
QR code phishing: using a QR code instead of a clickable link to send people to a fake login or payment page.
I paid for parking through a fake QR code. What now?
Call your bank or card issuer at once to block the card and dispute the payment, then report the code to the parking operator and to the police or fraud service.
Sources: FTC — scammers hide harmful links in QR codes, FTC — how to recognize and avoid phishing scams, NCSC — report scam emails, texts and websites, FTC — ReportFraud.ftc.gov