How QR code scams work
The FBI's 2022 warning sums up the method: criminals tamper with both digital and physical QR codes to replace real ones with malicious ones. On the street, that means a sticker over the code on a parking meter, which the FTC described in 2023 and again in September 2026. The fake code opens a site built to take your money, your personal information or both.
Online, the code arrives in an email or a text with a reason to scan it now: a package could not be delivered, there is a problem with your account, or someone noticed suspicious activity and you must change your password. The FTC says these stories are made up to create a sense of urgency. In 2025 it added a variant: a package you did not order, with a note asking you to scan a code to find out who sent it. The FTC says that code can lead to a phishing site that collects card numbers or passwords, or download malware onto your phone.
Common setups and the safe response
| Setup | Warned by | Safe response |
|---|---|---|
| Sticker over the code on a parking meter | FTC | Check for a sticker; type the known payment site yourself |
| Package you did not order, with a code to scan | FTC | Do not scan; the FTC says you can keep it as a gift |
| Text or email: a delivery failed, reschedule | FTC | Contact the carrier through its site or app |
| Message: a problem with your account | FTC | Log in the way you usually do |
| Message: suspicious activity, change your password | FTC | Change it in the app or site you know |
| A failed payment that only a code can fix | FBI | Find the company's number on a trusted site |
| A code that installs an app | FBI | Get apps only from the app store |
| A code that seems to come from a friend | FBI | Ask them by a number you already have |
The pattern behind every row is the same, and both agencies say it: do not let the code choose where you go. If a message seems real, contact the company through a phone number or website you know. To pay, the FBI says, type a known and trusted address yourself instead of following a code.
Read the code without opening it
The FTC notes that many QR readers show the destination before you open it, which is the moment to check. The QR code scanner on this site does exactly that. It reads a code from a photo, a screenshot or your camera, in your browser, without uploading the picture. For a web link it shows the full address and the domain it really goes to in large type, and it only opens the link when you press Open link. It flags four warning signs on its own:
- No HTTPS: an http:// address sends everything unencrypted.
- Text before an @ sign: everything before the @ is only a user name, so a trusted name there means nothing.
- A numeric IP address instead of a domain name.
- Letters from other alphabets: a domain label that starts with xn-- can contain characters that look like Latin letters.
Payment codes for crypto addresses or bank transfers get a warning that payments cannot be undone, with a reminder to check the recipient through another channel. A Wi-Fi code shows the network and password without joining anything. On a phone, the FBI advises against installing a separate scanner app, since most camera apps read codes already; the browser scanner is most useful on a computer, for a code in a screenshot, an email or a PDF.
What to check in the decoded address
No warning does not make a link safe. A misspelled domain with HTTPS passes all four of the scanner's checks, so read the address yourself. Here is what the scanner shows for a few made-up parking addresses, and what you should conclude:
| Decoded address | Real site | Scanner flag | Verdict |
|---|---|---|---|
https://city.example/park | city.example | None | Fine if it matches the sign |
https://citty.example/park | citty.example | None | Misspelled: stop |
http://city.example/pay | city.example | No HTTPS | Do not pay or log in |
https://city.example@pay-meter.example/ | pay-meter.example | Text before @ | Fake: stop |
https://203.0.113.7/pay | 203.0.113.7 | Numeric IP | Stop |
https://xn--cty-xxx.example/ | other alphabet | Starts with xn-- | Lookalike: stop |
https://short.example/x7Q2 | unknown yet | None | Shortened: expand first |
- The domain. The site is the name just before the first single slash after https://. It must match the city, operator or company named on the sign or in the letter. The FTC says to look for misspellings and a switched letter, and CISA lists misspelled addresses as a sign of phishing. How to check a suspicious link goes through this step by step.
- HTTPS. Without it, never type a password or card number. With it, you only know the connection is encrypted, not who runs the site.
- Shortened links. CISA names untrusted shortened URLs as a phishing sign, because they hide the destination. Paste the address into the HTTP header checker, which follows the redirects from our server and shows the final address without opening the page in your browser.
- The request. A page that wants a login, a card number or an app install right after a scan is where the FBI says to slow down. Leave and go to the company's site or app the way you usually do.
If you already paid or typed something in
Act on what you gave away, in this order. The FTC's steps:
- Paid by credit or debit card: report it to the card issuer or bank right away and ask for a refund.
- Paid by bank transfer or payment app: report it to the bank or the app right away and ask them to reverse the payment.
- Typed a password: change it now, along with every other account where you used the same one, and turn on two-factor authentication.
- Gave card or personal details: check your card and bank statements for charges you did not make, get your free credit reports, and consider a credit freeze or fraud alert. If someone used your Social Security number, go to IdentityTheft.gov for a recovery plan.
- Stop contact: do not reply to anyone through the site, who may push for more money or data.
- Report it at ReportFraud.ftc.gov.
If the site was a fake login page, treat it like a leaked password: what to do after a data breach has the full order of steps.
If you put QR codes in front of customers
Make it easy to spot a fake. Print the code as part of the sign instead of as a separate sticker, so one stuck on top stands out, and print your domain in plain text next to it so people can compare. Check your codes on site now and then for stickers. The QR code generator makes the code from your own address, and QR code size for print shows how large it has to be for the distance people scan from.
Frequently asked questions
Can scanning a QR code hack my phone?
The risk is the link inside it. The FTC warns that a code can take you to a phishing site that asks for card numbers or passwords, or download malware onto your phone. Look at the address before you open it, and keep your phone's operating system and apps updated.
How do I see where a QR code goes without opening it?
Many QR readers show the destination first, the FTC says. Our QR code scanner reads a photo, a screenshot or your camera picture and shows the full address and its domain, with warnings, and opens nothing until you press Open link. For a shortened address, an HTTP header checker shows where it redirects without loading the page in your browser.
Is a QR code on a parking meter safe?
Not automatically. The FTC and FBI both warn that scammers put their own code over the real one. Look for a sticker on top of the printed code, check that the address matches the city or operator named on the meter, and when in doubt type the payment address you know yourself, as the FBI advises.
What should I do if I paid through a fake QR code?
Contact the company you paid with right away: the card issuer, bank or payment app, and ask them to reverse the payment and refund it, as the FTC advises. If you typed a password, change it on that account and every account where you reused it. Report the scam at ReportFraud.ftc.gov.
Do I need a QR scanner app?
Usually not. The FBI notes that most phones have a scanner built into the camera app and advises against downloading a scanner app. On a computer, for a code in a screenshot or an email, a scanner in the browser like ours does the same without installing anything.
Sources
- FTC Consumer Alert, December 6, 2023: Scammers hide harmful links in QR codes (stickers on parking meters; codes in texts and emails with a made-up reason such as a missed delivery, an account problem or suspicious activity; inspect the URL for misspellings or a switched letter; do not scan codes in unexpected messages; contact the company through a number or site you know)
- FTC Consumer Alert, January 23, 2025: QR code on an unexpected package (phishing site or malware; change passwords, two-factor authentication, credit reports, statements, credit freeze or fraud alert; the law says you can keep unordered merchandise as a gift; IdentityTheft.gov)
- FTC Consumer Alert, September 3, 2026: See a QR code parked somewhere? (codes covered on parking meters; many QR readers show the link first; update your phone; if you scanned a bad code, do not engage, change reused passwords, check statements, report at ReportFraud.ftc.gov)
- FBI IC3 PSA I-011822-PSA, January 18, 2022: Cybercriminals tampering with QR codes (check the URL, look for tampering, no apps or scanner apps from codes, verify a failed payment and codes from friends by known numbers, type a trusted URL to pay)
- FTC: What to do if you were scammed (steps for card, bank transfer, wire, payment app, passwords and Social Security numbers; report at ReportFraud.ftc.gov)
- CISA Secure Our World: Recognize and report phishing (untrusted shortened URLs and misspelled addresses as signs of phishing; contact the company through a website or number you verify yourself)