QR Code Scams: How They Work and How to Protect Yourself
Have you ever scanned a QR code to pay, open a restaurant menu, visit a website, or download an app? QR codes can replace a long typed address with a quick camera scan. But a QR code can take you to an unsafe website just as easily as a legitimate one.
Published: 2026-09-29 · Updated: 2026-09-30 · Published by IZenica Technologies LLC
Check where a QR code leads before opening the link or making a payment.
What Is a QR Code Scam?
People often scan QR codes without checking where they lead. Scammers take advantage of that habit by placing fake codes on posters, parking meters, payment notices, emails, packages, or messages that appear to come from a trusted company. Their goal may be to steal login details or personal information, collect a payment, or persuade you to download something harmful.
These schemes are known as QR code scams. When a scammer uses a QR code to direct someone to a phishing website, the tactic may be called QR code phishing, or quishing. You do not need to be a computer expert to protect yourself. A few careful habits can help you recognize suspicious requests and respond if something goes wrong. For practical steps to protect your PC from viruses, see our related guide.
This guide explains what QR code scams are, how they work, where they appear, which warning signs to look for, and what to do if you have already scanned a suspicious code.
A QR code scam is an attempt to use a scannable code to put your money, information, or device at risk. QR stands for “Quick Response.” A QR code is a type of barcode that a smartphone can read. Depending on how it was created, it may open a web page, display contact information, connect to a Wi-Fi network, or start another action supported by your device.
QR codes themselves are not harmful. Businesses, restaurants, shops, and banks use them for legitimate purposes. The risk depends on where the code leads and what you do after scanning it.
For example, you might see a notice saying that a parking payment failed and that you must scan its code to avoid a fine. The code could open a site that looks like a payment service. If you enter your card details and pay on a fake page, you may have given that information to a scammer.
Another example is an email that appears to come from your workplace and asks you to scan a code to verify your account. The code may open a fake login page designed to capture your username and password.
In both cases, the QR code is the route to the trap. The scam relies on making you trust the message and act before checking it.
How Do QR Code Scams Work?
QR code scams often follow a similar pattern. Knowing the steps can help you spot a questionable request before you act.
Step 1: The Scammer Creates a Fake Message
The scammer starts with a message designed to get your attention. It may use the name or logo of a real organization to seem trustworthy.
- Your bank account needs verification.
- A package cannot be delivered.
- You have an unpaid parking fee.
- Your subscription is about to expire.
- You have won a prize.
- Your work account needs an urgent security check.
- A payment failed and must be completed again.
Step 2: The Scammer Adds a QR Code
The QR code is presented as the easiest way to solve the supposed problem. The message asks you to scan it instead of typing a website address, making the action seem quick and familiar.
A scammer might print a fake code and place it over a legitimate code on a public sign, or include it in an email, printed notice, package, or digital image.
Step 3: You Scan the Code
Your phone may show the destination before opening it. What happens depends on your camera, browser, and device settings.
Scanning a code does not automatically mean your phone has been infected or your information has been stolen. The risk depends on where the code leads and what you do next. Do not assume a website is safe just because it opened successfully.
Step 4: The Website Tries to Earn Your Trust
A fake website may copy a legitimate organization's colors, logo, layout, and wording. It may show a pop-up claiming that you have won a prize to tempt you into clicking and continuing the scam.
A copycat site may also use a web address with a small spelling change. HTTPS or a padlock icon does not prove that the site is legitimate; check the full address and verify the request independently.
If you enter sensitive information on a fake website, the scammer may collect it. Depending on the scheme, that information could be used to attempt account access, make unauthorized transactions, or commit further fraud.
Some QR codes can also start actions such as joining a Wi-Fi network or composing a message. Review any action your phone proposes before approving it.
A QR code does not prove that a message is genuine. Check the destination and why you are being asked to scan it.
What Are the Most Common Types of QR Code Fraud?
QR code scams can appear in many places. These examples can help you recognize what to watch for.
1. Fake QR Payment Codes
A fake payment code may appear on a business counter, invoice, donation notice, or payment request. A scammer might replace a legitimate code with one that sends money to an account they control, or use a code that opens a fake payment page.
Before paying, check the recipient's name and the amount shown in your payment app. If the details do not match what you expected, do not approve the transaction. If you are paying a business in person and something looks unusual, ask how it officially accepts payment.
2. Phishing Emails With QR Codes
Some phishing emails ask you to scan a QR code instead of clicking a regular link. The message might ask you to review a document, reset a password, approve a login, or verify a work account.
A QR code can make the destination harder to inspect before scanning, especially when it appears as an image in an email. If a work email asks you to scan a code to access an account, verify the request through your company's usual communication channel. When in doubt, open the company's known website directly.
3. Fake Delivery Notifications
You might receive a notice claiming that a package is delayed because of an address problem or a small unpaid fee. It may include a QR code that leads to a page asking for your address, card details, or payment.
Check your order through the retailer's official app, or use the tracking number on the delivery carrier's verified website. Be cautious if an unexpected message demands a small payment to release a package; the request may be a pretext to collect more valuable information.
4. QR Codes on Parking Tickets
A scammer may place a fake QR sticker over a legitimate code on a parking meter or send a false parking notice. The fake website might ask for a parking fee, card details, or personal information.
Look for signs of tampering. If possible, use the parking operator's official app, payment machine, or website instead. If the code appears to cover another sticker or the payment instructions seem unusual, check with the operator before scanning.
Restaurants often use QR codes to let customers view menus. This is a normal and convenient use of the technology, but someone could replace a restaurant's menu code.
A replacement may lead to an advertising page, a fake payment request, or a website asking for unnecessary personal details. If a menu code asks you to install an unfamiliar app or provide banking information, stop and ask restaurant staff for the official menu or website.
6. QR Codes That Promise Free Gifts or Prizes
Scammers may advertise a free phone, gift card, shopping voucher, or cash prize. After scanning, you might be asked to pay a small processing fee, complete a survey, provide card details, or share the offer with friends.
If you did not enter a competition, be cautious about an unexpected prize. Do not provide payment information just to claim a reward.
7. Fake Account Security Warnings
A QR code might be presented as a way to protect your account or prevent it from being closed. Its destination may imitate a bank, email provider, online store, or workplace login page.
Treat unexpected requests for passwords, one-time passcodes, recovery codes, or authentication approvals as suspicious. Verify the alert through the organization's official website or app.
8. QR Codes That Link to Harmful Downloads
Some QR codes lead to pages offering apps, software updates, or security tools. A fake page may trick you into downloading a file or installing an app from an untrusted source. The software may be harmful or lead you to install other unwanted apps.
Do not install software just because a QR code recommends it. Find the app through an official app store or the developer's verified website, and check its publisher and permissions.
How to Identify a Fake QR Code
There is no single visual sign that proves a QR code is fake. A fraudulent code may look just like a legitimate one. Pay attention to the context, the destination, and the action being requested.
Look for Stickers or Signs of Tampering
If a QR code is on a public notice, parking meter, payment machine, or business counter, look closely at how it has been placed. A sticker covering another code, damaged printing, inconsistent branding, or unusual instructions may deserve a closer look.
These signs do not prove that a scam is taking place, but they are reasons to verify the code before using it.
Preview the Website Address
Many smartphone cameras display a website address before opening it. Take a moment to read the address instead of tapping automatically.
Look for misspellings, unexpected words, strange combinations of letters, or a domain that does not match the organization you expected. A bank name in a web address from an unrelated domain should raise questions.
A padlock icon or HTTPS connection does not, by itself, prove that a website is trustworthy. Fraudulent websites can also use encrypted connections.
Watch Out for Urgent Messages
Scammers may try to rush you. A message might say you have ten minutes to pay, verify your account immediately, or risk losing access to a service.
Do not respond immediately. Verify the message through another trusted channel. Real organizations may set deadlines, but urgency alone does not prove a request is valid.
Ask Why the QR Code Is Necessary
Consider whether scanning the code makes sense. A restaurant menu should not need your banking password. A delivery tracking page should not need your email password. A basic software update should not require you to give a stranger a one-time passcode.
If the requested information does not fit the task, stop and check before continuing.
Do Not Rely Only on Official-Looking Material
Logos, colors, uniforms, and professional designs can be copied. A code in a familiar location may also have been altered. Verify the payment recipient, web address, or request instead of relying on the appearance of the notice.
How to Scan QR Codes Securely
You do not need to avoid every QR code. The goal is to use them carefully.
1. Use Your Phone's Built-In Camera
For ordinary QR codes, your phone's built-in camera is usually enough. Avoid installing an unfamiliar QR-scanning app just to read a code. If you use a separate scanner, choose a reputable app and review the permissions it requests.
2. Check the Link Before Opening It
When your phone previews the destination, read it carefully. If the address looks strange or unrelated to the business, do not continue. If the preview is unclear, use another trusted way to reach the organization.
3. Open Important Websites Directly
For banking, email, shopping accounts, and other sensitive services, consider opening the official app or typing the known website address yourself. You can also use a trusted bookmark you created earlier.
4. Confirm Payment Details
Before approving a payment, check the payee and amount in your payment app. Make sure the recipient matches the business you intended to pay; a slightly altered name or spelling may point to a different account.
If someone says you must scan a code to receive money, stop and verify the request. Payment processes differ between services, so follow instructions in your trusted payment app and never approve an unexpected transfer.
5. Update Your Phone
Install security updates for your phone and browser when they are available. Updates address known software vulnerabilities. They cannot spot every scam, but they are an important part of keeping your device secure.
6. Avoid Downloads From Untrusted Sources
Do not install software or open an unfamiliar file just because a QR code urges you to. If you need software, get it from a reputable app store or the developer's own website. Check the app name, publisher, permissions, and user information before installing.
7. Use Security Software When Needed
Depending on the product and device, reputable security software may help identify some harmful websites, downloads, or apps. No security measure can guarantee that every scam will be stopped. Good habits, software updates, and careful verification are still necessary.
Explore the related online safety and antivirus guides below for more information.
What Should You Do If You Have Already Scanned a Suspicious QR Code?
Do not panic. Scanning a QR code does not mean your phone has been hacked. What to do next depends on what happened after the scan.
If You Scanned the Code but Did Nothing Else
Close the suspicious page. Do not provide information, download files, approve a login, or follow additional instructions. If the page asks you to grant permission or take another action, do not approve it until you have verified that it is legitimate.
Check your browser's recent downloads and close any unusual pages. Keep your phone and browser updated.
If You Entered Your Password
Open the official service directly on a trusted device. Change the affected password as soon as possible. If you reused it on other accounts, change those passwords too.
Use unique passwords for important accounts, turn on multifactor authentication if available, and check recent account activity. Sign out of sessions you do not recognize if the service offers that option. If it was a work password, contact your IT or security team promptly.
If You Shared a One-Time Passcode or Authentication Code
Contact the relevant bank or service immediately through its official channel. Explain what happened, check recent account activity, and follow the provider's instructions to secure your account. Do not share additional verification codes with anyone who contacts you unexpectedly.
If You Entered Your Card or Bank Details
Use your bank or payment provider's official app or the phone number on your card or statement. Explain that your information may have been compromised. Ask whether to lock or replace your card, dispute an unauthorized transaction, or monitor the account.
If you lost money, report the transaction promptly. Keep messages, screenshots, payment references, and other evidence.
If You Downloaded an App You Do Not Know
Do not open it again until you have checked it. If it looks suspicious, remove it using your device's standard app-management settings. Review any permissions it received, such as access to accessibility features, notifications, files, or device management.
If you cannot remove the app or believe the device is still affected, follow the device manufacturer's guidance and use reputable security software where appropriate. If you entered passwords after installing it, change them from a separate trusted device.
Contact your bank, card issuer, or payment provider through its official app or the number on your card or statement. If your Social Security number or other identity information may have been exposed, visit IdentityTheft.gov for recovery guidance.
Report a scam to the Federal Trade Commission at ReportFraud.ftc.gov. For online-enabled fraud, you can also report it to the FBI's Internet Crime Complaint Center at IC3.gov. Save transaction information, messages, screenshots, and report details.
Be cautious of anyone who offers to recover your money for an upfront fee or asks for your banking password or one-time passcode.
Are QR Code Scams Possible on Android and iPhone?
Yes. Both Android phones and iPhones can scan QR codes, so users of either platform may encounter fake links. The available protections depend on the operating-system version, browser, app, and security settings.
Android QR Code Safety
Use your phone's built-in camera or another reputable scanning method. Check the destination before opening it, keep Android and your apps up to date, and do not install unknown programs from untrusted sources.
If you suspect an unsafe app, check your installed apps and their permissions. Android settings vary by manufacturer, so menu names may differ.
iPhone QR Code Safety
Use the iPhone camera or a trusted scanning method, check the website address before visiting it, and install iOS updates when available. Do not enter your Apple Account password or banking details on a page just because it opened after a scan. For important tasks, go directly to the official app or website.
Be cautious if an unfamiliar configuration profile or app appears after scanning a code. Do not assume it is safe; consult Apple's official support guidance.
Will Antivirus Software Stop QR Code Scams?
Antivirus and security programs can provide useful protection, but their capabilities differ. Depending on the product, device, and settings, a security tool may detect certain malicious websites, suspicious downloads, or harmful apps. Some products also provide web protection or phishing warnings.
QR code scams can rely on social engineering rather than malware. A fake payment request, for example, may not need harmful software to steal money. A fake login page may work simply by convincing someone to enter a password.
That is why security software should be one part of a broader safety plan. Update devices, verify suspicious messages, secure accounts with strong and unique passwords, and check payment details before approving a transaction.
When choosing security software, review the product's actual feature list and confirm that the features you need are supported on your device.
Final Thoughts: Think Before You Scan
QR codes are useful tools, and there is no need to fear every code you encounter. Remember that a code can lead to a legitimate website or a fake one.
Pause to check the destination, question unexpected payment requests, avoid unknown downloads, and verify urgent messages through trusted channels. If a QR code asks for a password, one-time passcode, payment, or unfamiliar app installation, stop and confirm the request is genuine.
A few seconds of caution can help protect your money, personal information, and online accounts. For more practical guidance, explore the related antivirus, malware prevention, phishing awareness, and online safety guides below. For practical steps to protect Windows 11 from malware, see our related guide.
Check before you trust. Stay informed. Scan carefully.
Frequently asked questions
- What is a QR code scam?
- A QR code scam uses a QR code to direct someone to a fake website, payment request, or download intended to steal money or personal information.
- Can scanning a QR code infect my phone?
- Scanning a code does not automatically mean your phone is infected. The risk depends on where it leads and what you do next. Do not enter information, download files, or approve unexpected actions.
- How can I tell whether a QR code is fake?
- Check for signs of tampering, preview the full website address, and consider whether the request makes sense. If anything looks unusual, use the organization's official app or website instead.
- Can I trust a QR-code website if it uses HTTPS?
- No. HTTPS encrypts the connection, but it does not prove that the website is legitimate. Check the domain and verify the request through a trusted channel.
- What should I do if I entered my password on a fake page?
- Change the password through the official service on a trusted device, change it anywhere you reused it, turn on multifactor authentication if available, and review account activity.
- What should I do if I paid through a fake QR code?
- Contact your bank or payment provider immediately through its official app or phone number. Ask how to report the transaction and protect your account.
- Are QR codes on parking meters safe?
- Some are legitimate, but a code may be replaced with a fake sticker. Check for tampering and use the parking operator's official app, website, or payment machine if anything seems unusual.
- Should I install a separate QR scanner app?
- Most people can scan ordinary codes with a phone's built-in camera. If you choose another scanner, use a reputable app and review the permissions it requests.
- Will antivirus software stop every QR code scam?
- No. Security software may detect some harmful websites or downloads, but it cannot guarantee that every scam will be blocked. Check links and payment requests yourself too.
Related Online Security Articles
View all Bitdefender guides · Explore the Online Security Guide · What to do after clicking a phishing link · Learn what malware is and how to respond · Protect your identity online