HIGH RISK
QR Code Scam (Quishing)
Malicious QR codes placed on parking meters, restaurant menus, flyers, and fake packages that lead to phishing sites or malware downloads.
Losses: Emerging — FBI issued multiple warnings in 2023-2024
Targets: Anyone who scans QR codes, urban dwellers, restaurant customers
Updated: 2026-01-07
Also known as: Quishing • QR Phishing • Malicious QR Code • Parking Meter Scam
1How It Works
QR codes can't be "read" by humans, making them perfect for hiding malicious links.
**Physical QR scams:**
1. **Parking meters**: Stickers placed over legitimate payment QR codes
2. **Restaurant menus**: Fake QR codes on tables or menus
3. **Flyers/Posters**: QR codes promising deals, free items, or event tickets
4. **Fake package slips**: "You missed a delivery — scan to reschedule"
5. **Business cards**: QR codes at networking events
**What happens when you scan:**
- Taken to phishing site that looks legitimate
- Prompted to enter payment info or login credentials
- Malware automatically downloads to your phone
- Redirected to app store to install malicious app
**Why it's effective:**
- People trust QR codes after COVID normalized them
- Can't preview URL before scanning (unlike links)
- Easy to place stickers over legitimate codes
- Works on both iPhone and Android
How Scammers Make Contact
Physical QR codesEmail attachmentsText messagesFlyers and posters
2Warning Signs & Red Flags
- QR code sticker placed over another QR code
- QR code on unofficial-looking flyer or poster
- Code leads to URL that doesn't match expected company
- Website immediately asks for payment or personal info
- QR code on unsolicited mail claiming you missed a delivery
- Code prompts you to download an app
- URL uses URL shortener hiding the real destination
- QR code in email (unusual — why not just include the link?)
3Real-World Example
"I scanned a QR code on a parking meter in Austin to pay for parking. The site looked official and I entered my credit card. Within hours, there were $1,500 in fraudulent charges. Scammers had placed stickers with fake QR codes over the real ones on dozens of meters downtown."
— Austin Police Department Warning, 2022
4How to Protect Yourself
- Preview the URL before opening — most phones show this
- Check if QR code is a sticker covering another code
- Don't scan QR codes from unknown sources
- Type URLs directly rather than scanning when possible
- Keep your phone's software updated
- Don't enter payment info on sites reached via QR code
- For parking, use official apps rather than QR codes
- Be suspicious of QR codes in emails — legitimate businesses link directly
5What To Do If You're a Victim
- 1If you entered payment info, contact your bank immediately
- 2If you installed an app, delete it and run antivirus
- 3Change passwords for any accounts you logged into
- 4Monitor your accounts for unauthorized activity
- 5Report physical QR scams to local police
- 6Report to FTC at ReportFraud.ftc.gov
- 7Report phishing URLs to Google Safe Browsing
Report This Scam
?Frequently Asked Questions
What is QR Code Scam (Quishing)?
Malicious QR codes placed on parking meters, restaurant menus, flyers, and fake packages that lead to phishing sites or malware downloads. QR codes can't be "read" by humans, making them perfect for hiding malicious links.
**Physical QR scams:**
1. **Parking meters**: Stickers placed over legitimate payment QR codes
2. **Restaurant menus**: Fake QR codes on tables or menus
3. **Flyers/Posters**: QR codes promising deals, free items, o...
How common is this type of scam?
QR Code Scam (Quishing) is classified as a high risk threat. Reported losses: Emerging — FBI issued multiple warnings in 2023-2024. This primarily targets Anyone who scans QR codes, urban dwellers, restaurant customers.
Can I get my money back?
Recovery depends on how you paid. Credit card payments may be reversed through chargebacks. Wire transfers and cryptocurrency are rarely recoverable. Report immediately to your bank and file complaints with the FTC at reportfraud.ftc.gov and FBI IC3 at ic3.gov.
How do I report this?
Report to the FTC at reportfraud.ftc.gov. For internet crimes, file with FBI IC3 at ic3.gov. For identity theft, visit identitytheft.gov. Also contact your local police and your bank.
Sources & References
Related Scams
Toll Road Text Scam
Fake text messages claiming you have an unpaid toll and must pay immediately to avoid late fees or license suspension.
Package Delivery Scam
Fake texts claiming USPS, FedEx, or UPS couldn't deliver your package and asking you to click a link to reschedule or pay a fee.
Fake Online Store
Fraudulent e-commerce websites that take your payment but never deliver products, or send counterfeit/inferior goods.
Think You've Encountered This Scam?
Use our free AI scanner to analyze suspicious messages, websites, or phone numbers.
Scan Now — It's Free