A restaurant menu. A parking sign. A parcel with a “scan to see your gift” card. QR codes make everyday tasks easier, so it is tempting to point your camera and tap without thinking.
But a familiar setting does not guarantee a trustworthy destination. QR code scams use that moment of convenience to send you somewhere you did not intend to go.
Before scanning a QR code, check who supplied it and whether it looks altered. Before opening the link, inspect the address. Before entering information or paying, independently confirm the website and request.
Table of Contents
What Are QR Code Scams?
QR code scams use scannable codes to direct people to fraudulent websites or payment destinations. When the goal is to steal information through a fake page, the technique is often called quishing, short for QR code phishing.
The US Postal Inspection Service describes scams in which criminals impersonate familiar organizations and use QR codes to collect passwords, card details, and other personal information.
The code itself cannot tell you whether the person behind it deserves your trust. Treat it as you would a link in a message.
Source: US Postal Inspection Service: Quishing
How to Check a QR Code Before Scanning or Opening It
1. Check Where It Came From
Ask whether you expected the code and whether its purpose makes sense.
A menu code handed to you by restaurant staff has a different context from an unexpected email saying your account will close unless you scan immediately.
Be particularly cautious about codes attached to messages claiming:
- A parcel could not be delivered.
- Your account needs urgent verification.
- A payment failed.
- You must change your password immediately.
Open the relevant service yourself to check the claim. Do not use the sender’s contact details as your only verification.
Source: FTC: Scammers Hide Harmful Links in QR Codes
2. Look for Stickers or Signs of Tampering
On a physical sign, look for a second sticker covering the original code, mismatched printing, or a label that appears recently added.
These are reasons to pause, not proof of fraud. A legitimate business may also replace its labels.
The FTC has warned about criminals covering genuine parking codes with their own. If something looks wrong, ask staff or use the operator’s independently verified payment method.
Source: FTC: QR Codes on Parking Meters
3. Preview the Link Before Opening It
Use your phone’s built-in camera or scanner where available. If it displays a link preview, read it before tapping.
Check the actual domain, not just a familiar word somewhere in the address. For example:
| Illustrative address | What it means |
|---|---|
restaurant.example/menu | The website is on restaurant.example. |
restaurant.example.verify-now.test | The website is on verify-now.test. |
verify-now.test/restaurant.example | The familiar name is only in the page path. |
These are fictional examples, not websites to visit.
A shortened or unfamiliar address is not automatically malicious, but it may prevent you from recognizing the destination. When you cannot verify it, use another route.
The FBI recommends checking QR destinations for altered letters and misleading domains.
Source: FBI: Cybercriminals Tampering With QR Codes
4. Do Not Let a Logo or HTTPS Decide for You
A convincing design is easy to imitate. HTTPS protects the connection to a website; it does not establish that the business operating it is honest.
If a page requests sensitive information, confirm the address independently. A familiar logo and a polished payment form are not enough.
Source: Cleveland Police: Shopping Safely Online
5. Check Whether the Request Fits the Task
Imagine scanning a restaurant menu and being asked for your email password. Or scanning a parking sign and being told to install a “security update.”
The mismatch is the warning.
Ask: Why would this service need this information to do what I requested?
If an app is genuinely needed, find it through the official app store and verify its publisher. Do not install an unfamiliar download offered by the QR page.
The FBI advises using app stores instead of downloading apps through QR codes.
6. Verify the Recipient Before Paying
A QR code can direct money to the wrong recipient. Check the business name, amount, and currency before confirming any transaction.
For an unexpected payment request, navigate to a known website or official app yourself. If necessary, contact the business through independently obtained details.
Travelers should apply the same checks to accommodation requests. Our guide to hotel payment links sent on WhatsApp explains how to verify a request against your original booking.
For broader payment habits, see our guide to ICT in personal finance and shopping.
Be Careful With QR Codes Inside Unexpected Packages
An unsolicited gift can make you curious, especially when a card says scanning will reveal the sender.
The FBI has warned about packages containing QR codes that lead recipients toward requests for personal or financial information, or malicious software downloads.
Do not scan an unknown code to investigate a mystery parcel. Check your order history and contact the retailer through its genuine website if needed.
Source: FBI: Unsolicited Packages Containing QR Codes
What If You Already Scanned a Suspicious QR Code?
What matters is what happened afterward.
| What happened | What to do next |
|---|---|
| You saw a preview but did not open it | Dismiss it. A preview alone does not establish that an account or device was compromised. |
| You opened the page but entered nothing | Close it. Do not download anything, grant permissions, or continue interacting. |
| You entered a password | Change it through the genuine service, including anywhere you reused it. Review active sessions and enable multifactor authentication. |
| You entered card details or paid | Contact your bank through its official app or the number on your card. Explain what you shared or authorized and ask about protecting the account and disputing the transaction. |
| You installed software or granted access | Stop using the suspicious software and seek trusted device-security support. Use another trusted device for sensitive account recovery if compromise is suspected. |
Keep relevant screenshots and transaction records. Report the code to the venue or impersonated business. For US incidents, reports can also be submitted through ReportFraud.ftc.gov or IC3.gov. Recovery of money is not guaranteed.
For account protection basics, read our digital citizenship and online etiquette guide.
Frequently Asked Questions
Can scanning a QR code hack your phone?
Scanning does not automatically mean your phone has been hacked. Risk depends on the destination and subsequent actions, including opening malicious content, installing software, or providing information. Keep your phone and browser updated.
Are restaurant QR code menus safe?
Many are legitimate. Check with staff if a label looks altered or the page requests unexpected information. Ask for another way to view the menu if you cannot verify the code.
Do I need a separate QR scanner app?
Usually not. Many phones include scanning in the camera or built-in tools. The FBI recommends avoiding unnecessary scanner downloads.
Can I tell whether a QR code is safe by its appearance?
No. A neat code can lead to a fraudulent website. Check its source, destination, and requested action rather than judging the pattern.
Make the pause a habit: check the source, inspect the destination, and verify the action before you proceed.
