QR Code Scams: When Not to Scan

QR codes are everywhere: on menus, parking meters, packages and mailers. They’re convenient, which is exactly why QR code scams work. In September 2026, the FTC warned that people have reported scammers covering real QR codes on parking meters with codes of their own. A scan can lead to a fake site designed to steal your money, your personal information or both.

QR code scams are a kind of phishing. Learn the basics in what is phishing?

How do QR code scams work?

A QR code is just a shortcut to a web address. When you scan it, your phone opens whatever site the code points to. Scammers swap in a code that leads to a look-alike payment page or login screen. Anything you type there, such as a card number, password or personal details, goes to the scammer.

The trick works because QR codes all look alike. You can’t tell a real one from a fake by looking at the pattern, only by checking where it leads.

Where do fake QR codes show up?

• Parking meters and pay stations. The FTC says scammers place their own QR code over the legitimate one.
• Packages you didn’t order. In a brushing scam, the FTC says the package may include a note with a QR code to “find out who sent it” or “process a return,” which can lead to a phishing site. See brushing scams.
• Emails, texts and letters that ask you to scan a code to pay a bill, confirm a delivery or fix an account problem.

EXAMPLE — SCAM

Today 8:30 AM●●● ▮

From: Parking Services <notice@citypark-pay.example.com>

Subject: Unpaid parking session — scan to avoid penalty

Our records show an unpaid parking session on your vehicle. To avoid a $75 late penalty, scan the QR code below with your phone within 24 hours and complete payment.

[QR code image]

Payment portal: https://citypark-pay.example.com/pay

How can you check a QR code before scanning?

The FTC’s tips:

1. Inspect the link. Many phone cameras show a preview of the web address before opening it. Look for spelling mistakes or switched letters, and make sure the name matches the business.
2. Protect your phone. Update your phone’s operating system and apps to help keep scammy links from turning into a hack.
3. Protect your accounts with strong passwords and multi-factor authentication.

Two more habits help:

• Look at the code itself. On a meter or sign, check whether it’s a sticker stuck over another code.
• Go around the code. Pay through the parking operator’s official app or website, which you look up yourself, or pay at the meter.

Our 10 checks to tell if a website is legit also apply to any page a QR code opens.

What if you already scanned and paid?

The FTC says to take these steps if you think you scanned a bad code:

• Don’t interact with the scammer. If you contact someone through the fake site, they may try to get more money or information from you.
• Change your password right away if you entered a username or password, and change it anywhere else you use the same one.
• Review your transactions. Check your credit card and bank statements for charges you didn’t make, and call your card company if you see any.
• Report it to the FTC at ReportFraud.ftc.gov. To report a fake payment site, see how to report a scam website.

If you entered card details or your Social Security number, our first-hour checklist after a scam covers the next steps. For more on look-alike sites, see phishing emails and fake websites.