Scanning a QR code has become a reflex. You aim your phone at a square on a parking meter, a restaurant table, or an invoice, a page loads, and you pay without a second thought. That frictionless habit is a gift to scammers, because a fake code looks exactly like a real one, and by the time you notice anything is off, you may have handed your payment details or your money straight to a stranger. The square itself gives you no clue.
QR code payment scams, sometimes called quishing, work by getting you to scan a code that leads somewhere you did not intend, whether a fake payment page, a credential-stealing login, or a transaction pre-filled to the attacker. The Federal Trade Commission has warned that scammers hide harmful links in QR codes, including by covering real codes in public places with their own. Here are eleven patterns to recognize, and a short routine for checking any code before you tap pay.
Key Takeaways
Most QR scams share one move: a code sends you to a fake page or a pre-set payment. Watch for stickers placed over real codes on meters and tables, “scan to get a refund or prize” messages, codes in unexpected emails or letters, and requests to pay a fee or fine by scanning. Before paying, preview the link, confirm the payee name matches the business, and prefer the merchant’s own app. A genuine refund never requires you to scan and then pay.
1. A Fake Sticker Over a Real Code
The most common trick is also the simplest. Scammers print their own QR code on a sticker and press it over the legitimate one on a parking meter, EV charger, or payment terminal. You scan what looks like the official code and land on a convincing but fake payment page. The FTC has specifically flagged this in public places. Before scanning a code in the wild, run a finger over it and look for a sticker edge or a code that sits oddly on top of the surface.
2. A Swapped Code on a Restaurant Table or Menu
Order-and-pay-at-the-table setups are convenient and easy to tamper with. A scammer can stick a fake code over the one on a table tent, menu, or receipt, sending your payment to them instead of the restaurant. If a tabletop code leads to a checkout that looks generic, misspelled, or unrelated to the restaurant’s name, stop. Ask a staff member to confirm the correct way to pay, or simply pay at the counter or with your card.
3. “Scan to Get a Refund or Prize”
Be very suspicious of any message telling you to scan a code to receive money, a refund, or a prize. Real refunds are pushed back to your original payment method; they never require you to scan a code and then approve a payment. If scanning leads to a page that asks you to log in, enter card details, or send a small “processing” amount to unlock your reward, it is a scam designed to take, not give.
4. A Code in an Unexpected Email or Letter
Quishing often arrives by mail. An email or physical letter claims to be from your bank, a delivery service, or a government office and urges you to scan a QR code to resolve an urgent issue. The code leads to a fake login or payment page. Treat any unsolicited code that pressures you to act fast as a red flag, and instead reach the organization through its official app or a number you already have, never through the code in the message.
5. A Spoofed Charity or Donation Code
At events, on flyers, or after disasters, fake donation QR codes ride on people’s generosity. A scammer posts or hands out a code that routes your gift to their account rather than the cause. If you want to give, look up the charity directly and donate through its official website or a known platform, rather than scanning a code from a poster, a street solicitor, or an unverified social post.
6. The “Missed Delivery, Scan to Pay a Fee” Code
A notice on your door or in your inbox says a package needs a small redelivery or customs fee, payable by scanning a code. Legitimate carriers rarely collect surprise fees this way, and the code leads to a page that harvests your card. If you are expecting a package, check its status in the carrier’s official app or website using the tracking number you already have, and ignore the code and the urgency entirely.
7. A Crypto or Investment Payment Code
QR codes make sending cryptocurrency fast, which scammers exploit. You are pressured to scan a code that pre-fills a crypto payment to a wallet you cannot easily verify, often as part of a fake investment, romance, or “unlock your funds” pitch. Because crypto payments are irreversible, treat any code that moves crypto with extreme caution, and never scan one provided by someone who contacted you or promised outsized returns.
8. An Event Ticket or Check-In Code
Fake event codes target people in a hurry to get in. A code on a resold ticket, a lookalike event page, or a “scan to check in” sign leads to a payment or a login that steals your details. Buy tickets only through the official venue or a reputable seller, and be wary of check-in codes that ask for payment or account credentials. Real check-in usually validates a ticket you already hold rather than asking you to pay again.
9. A Utility or Invoice Code Pre-Filled to the Attacker
On a bill or invoice, a QR code can quietly carry a payee and amount already set. A tampered or fraudulent invoice sends a code that pre-fills the payment to the scammer’s account while showing an amount that looks right. Before confirming, check that the payee name on the payment screen matches the business you actually owe, and pay recurring bills through your provider’s official portal or app rather than a code on a document you did not expect.
10. A Swapped Tip-Jar or Counter Code
Small businesses that take tips or payments by QR are easy targets for a sticker swap at the counter. A fake code over the shop’s real one diverts tips or payments to a scammer. As a customer, glance at whether the code looks like an add-on sticker, and confirm the business name on the payment page. As an owner, check your posted codes regularly for tampering, since a swapped code can run for days unnoticed.
11. A Code That Installs an App or Auto-Fills a Payment
Some codes do more than open a web page. A malicious QR can push you to download a sketchy app that then requests payment permissions, or open your payment app with an amount and recipient already filled in, hoping you tap confirm out of habit. Never install an app prompted by a random code, and always read the recipient and amount carefully before approving any payment, even when a code seems to have set it all up for you.
How to Check a QR Code Before You Pay
You do not need special tools, just a few seconds of habit. Run through these before any scan leads to a payment:
- Inspect the physical code. In public, feel for a sticker placed over another code, and skip codes that look added on to a meter, table, or terminal.
- Preview the link first. Most phone cameras show the web address before opening it, so read the domain and make sure it matches the real business rather than a lookalike or a random site.
- Check the payee name and amount. On the payment screen, confirm the recipient is the business you mean to pay and the amount is right, before you approve.
- Prefer the official app. For parking, bills, deliveries, and tickets, use the provider’s own app or website you reached yourself instead of a code you were handed or sent.
- Distrust urgency and rewards. Any code pushing you to act fast, pay a surprise fee, or scan to receive money is a warning sign, not a shortcut.
This article is general information, not legal, financial, or professional security advice, and it cannot cover every situation. Scam tactics, payment tools, and protections change over time and vary by provider and location. Confirm any payment through the business’s official channels, and if you are unsure about a code or think you have been targeted, contact the company directly and consult a qualified professional. You can report scams to the FTC at ReportFraud.ftc.gov and to the FBI’s Internet Crime Complaint Center.
Frequently Asked Questions
What are the most common QR code payment scams?
The most common is a fake sticker placed over a real code in public, such as on a parking meter, EV charger, or restaurant table, which sends your payment to a scammer. Others include “scan to get a refund or prize” messages, codes in unexpected emails or letters that lead to fake login and payment pages, spoofed charity and delivery-fee codes, and invoice codes pre-filled to the attacker. The Federal Trade Commission has warned about scammers hiding harmful links in QR codes, so treat any unexpected code with caution.
How can I tell if a QR code is fake?
You often cannot tell from the square itself, so check the context and the destination. Look for a sticker placed over another code on a physical surface, preview the web address your camera shows before opening it, and confirm the domain matches the real business rather than a lookalike. On the payment screen, verify the payee name and amount. If a code arrived unexpectedly, pressures you to act fast, or promises money, treat it as a scam and use the company’s official app instead.
Is it safe to scan QR codes to pay for parking or at restaurants?
It can be, as long as you verify before paying, because these are exactly the places scammers target with swapped stickers. Feel the code for a sticker edge, preview the link, and confirm the payment page belongs to the parking operator or restaurant. When in doubt, use the operator’s official app, pay at a staffed counter, or use your card directly. The convenience is real, but a few seconds of checking prevents most QR payment scams.
Do QR codes give scammers access to my phone or bank account?
A QR code is essentially a link, so scanning one does not automatically hand over your accounts, but where it leads can. A fake code can send you to a page that steals your login or card details, prompt you to install a harmful app, or open a payment pre-set to the scammer. The danger is in what you do after scanning, which is why previewing the link, checking the payee, and avoiding app installs or payments prompted by unexpected codes matters so much.
What should I do if I paid through a scam QR code?
Act quickly. Contact your bank or card issuer using the number on your card to report the transaction and ask about stopping or reversing it, and change any passwords you entered on the page the code opened. If you installed anything, remove it and run a security check. Then report the scam to the FTC at ReportFraud.ftc.gov and the FBI’s Internet Crime Complaint Center at IC3.gov, and keep records of the code, page, and payment to support your claim.
The Bottom Line
QR codes are convenient precisely because they hide where they lead, and that is the whole opening for scammers. Whether it is a sticker over a parking meter, a swapped table code, a fake refund, or a pre-filled invoice, the fix is the same short habit: inspect the physical code, preview the link, confirm the payee and amount, and prefer the official app. A genuine refund never asks you to scan and pay. For more on guarding your money, see our guides to spotting invoice overpayment scams and Zelle and peer-to-peer payment red flags, or browse the YouGottaRead Business section.
