In short
A scammer covers a real QR code with their own, or sends one in a message. Scanning it opens a fake site that steals your details or installs malware.
What it looks like
What you might see on a parking meter, written by us as an example.
Scan to pay for parking [a QR code sticker placed over the original] Pay now at park-pay-fast.example
How to spot it
A sticker on top of the original
The FTC reports scammers covering real meter codes with their own.A QR code in a message you did not expect
Texts or emails about a failed delivery or a problem with your account.A link with a switched letter
Check the link preview for misspellings before you open it.What to do
- Do not scan a QR code in a message you did not expect. Contact the company using a number or site you already know.
- At a meter, check the link preview and use the official app if the code looks stuck on.
- If you scanned a bad code, do not interact with the site. Change passwords, especially any you reuse.
- Review your card and bank statements for charges you did not make, then report it at ReportFraud.ftc.gov.
Where to report it
FTC ReportFraudreportfraud.ftc.gov
Sources
- US Federal Trade Commission: See a QR code parked somewhere? Don't scan it…yet! (3 Sep 2026)
- US Federal Trade Commission: Scammers hide harmful links in QR codes to steal your information (5 Dec 2023)
More like this
Written from public fraud-agency notices. Figures and advice are checked against the pages listed under Sources.