● HIGH RISK

QR Code Scam (Quishing)

A malicious QR code — slapped over a parking meter, tucked into a menu, mailed in a fake package — sends your phone to a phishing page or a malware download. You cannot read a QR code with your eyes, which is the whole point. Check where it actually lands before you enter anything.

Losses: Emerging — FBI issued multiple warnings in 2023-2024

Targets: Anyone who scans QR codes, urban dwellers, restaurant customers

Updated: 2026-01-07

Also known as: Quishing · QR Phishing · Malicious QR Code · Parking Meter Scam

How It Works

QR codes can't be "read" by humans, making them perfect for hiding malicious links. **Physical QR scams:** 1. **Parking meters**: Stickers placed over legitimate payment QR codes 2. **Restaurant menus**: Fake QR codes on tables or menus 3. **Flyers/Posters**: QR codes promising deals, free items, or event tickets 4. **Fake package slips**: "You missed a delivery — scan to reschedule" 5. **Business cards**: QR codes at networking events **What happens when you scan:** - Taken to phishing site that looks legitimate - Prompted to enter payment info or login credentials - Malware automatically downloads to your phone - Redirected to app store to install malicious app **Why it's effective:** - People trust QR codes after COVID normalized them - Can't preview URL before scanning (unlike links) - Easy to place stickers over legitimate codes - Works on both iPhone and Android

How Scammers Make Contact

Physical QR codesEmail attachmentsText messagesFlyers and posters

Warning Signs & Red Flags

QR code sticker placed over another QR code
QR code on unofficial-looking flyer or poster
Code leads to URL that doesn't match expected company
Website immediately asks for payment or personal info
QR code on unsolicited mail claiming you missed a delivery
Code prompts you to download an app
URL uses URL shortener hiding the real destination
QR code in email (unusual — why not just include the link?)

Real-World Example

"I scanned a QR code on a parking meter in Austin to pay for parking. The site looked official and I entered my credit card. Within hours, there were $1,500 in fraudulent charges. Scammers had placed stickers with fake QR codes over the real ones on dozens of meters downtown."
— Austin Police Department Warning, 2022

How to Protect Yourself

Preview the URL before opening — most phones show this
Check if QR code is a sticker covering another code
Don't scan QR codes from unknown sources
Type URLs directly rather than scanning when possible
Keep your phone's software updated
Don't enter payment info on sites reached via QR code
For parking, use official apps rather than QR codes
Be suspicious of QR codes in emails — legitimate businesses link directly

What To Do If You're a Victim

1If you entered payment info, contact your bank immediately
2If you installed an app, delete it and run antivirus
3Change passwords for any accounts you logged into
4Monitor your accounts for unauthorized activity
5Report physical QR scams to local police
6Report to FTC at ReportFraud.ftc.gov
7Report phishing URLs to Google Safe Browsing

Report This Scam

FTC Report Fraud FBI IC3 Identity Theft

Frequently Asked Questions

What is QR Code Scam (Quishing)?

What are the warning signs of QR Code Scam (Quishing)?

QR code sticker placed over another QR code. QR code on unofficial-looking flyer or poster. Code leads to URL that doesn't match expected company. Website immediately asks for payment or personal info. QR code on unsolicited mail claiming you missed a delivery.

How do I protect myself from QR Code Scam (Quishing)?

Preview the URL before opening — most phones show this. Check if QR code is a sticker covering another code. Don't scan QR codes from unknown sources. Type URLs directly rather than scanning when possible.

What should I do if I'm a victim of QR Code Scam (Quishing)?

If you entered payment info, contact your bank immediately. If you installed an app, delete it and run antivirus. Change passwords for any accounts you logged into. Monitor your accounts for unauthorized activity.

How serious is this threat?

We rate this high risk. Reported losses: Emerging — FBI issued multiple warnings in 2023-2024. Most exposed: Anyone who scans QR codes, urban dwellers, restaurant customers.

Can I get my money back?

Recovery depends on how you paid. Credit card payments may be reversed through chargebacks, while wire transfers and cryptocurrency are rarely recoverable. Report immediately to your bank and file complaints with the FTC at reportfraud.ftc.gov and the FBI IC3 at ic3.gov.

How do I report QR Code Scam (Quishing)?

Report to the FTC at reportfraud.ftc.gov. For internet crimes, file with the FBI IC3 at ic3.gov. For identity theft, visit identitytheft.gov. You should also contact your local police and your bank.

Sources & References

Related Scams

Toll Road Text Scam

A text says you owe a small unpaid toll and must pay immediately to avoid fees or losing your license. The toll agency did not send it; the link harvests your card and details. Real toll systems do not collect by panic text — go to the agency's actual site if you are unsure.

Package Delivery Scam

A text claims USPS, FedEx, or UPS could not deliver your package and needs you to click to reschedule or pay a fee. The link is the point — it leads to a fake page built to take your card and login. Carriers do not charge redelivery fees by text.

Fake Online Store

A storefront with real-looking products and unreal prices takes your payment and either ships nothing or sends a counterfeit. Many are built fast and abandoned just as fast. Pay by credit card so you can dispute it, and be wary of a brand-new site selling brand-name goods for a fraction.

Think you've encountered this scam?

Use the free AI scanner to analyze suspicious messages, websites, or phone numbers.

Scan Now — It's Free