Guide Scams and phishing
QR code scams: how to spot a fake code and what to do if you've scanned one
A QR code is a link or a payment you can't read until your phone scans it. That's why scammers use codes instead of links: stuck over the real code on a parking meter, sent in a text about a parcel, or sent by a "buyer" who wants to pay you. Here's how to check a code before you confirm anything, and what to do if it's already happened.
Key points
- A QR code can open a fake login page, download an app or pre-fill a payment. You only see what's inside after scanning – so read the address before you open it.
- Look for a sticker placed over the original code on parking meters, chargers and posters. The FBI and the FTC have both warned about tampered codes. Pay by card, cash or the operator's official app instead.
- You never need to approve anything to receive money. If someone sends you a QR code so you can "get paid", they want you to send money to them.
- Put a photo or screenshot of the code into our link checker: your browser reads the code, the image never leaves your device, and we check the link only when you click.
Why scammers use QR codes
You can read a link in a text message. You can't read a QR code – it's a square of dots that only reveals what's inside once your phone scans it. And because we use QR codes for payments, tickets and menus every day, we tend to trust them. A code can contain:
- a link to a fake website – a bank login, a "payment page", a "parcel check",
- a link to download an app – the FTC warns a malicious code can install software that steals your information,
- a pre-filled payment – your banking app offers a transfer to the scammer's account,
- an invitation to link a device – a code that connects your messaging account to someone else's computer (see below).
Four places fake QR codes turn up
1. Stickers on parking meters, chargers and posters
In January 2022 the FBI warned that criminals were tampering with QR codes in public places, replacing real codes with their own to steal payments and card details. In December 2023 the FTC specifically named parking meters. The code opens a page that looks like a parking payment, but your money and card number go to the scammer.
2. QR codes in texts and emails
The FTC describes messages about a failed delivery, a "problem with your account" or "suspicious activity" that ask you to scan a code. According to the FTC, these messages create a sense of urgency so you scan and open the link without stopping to think. It's the same trick as a parcel delivery scam text, just in a different wrapper.
3. "Scan this to get paid"
The most expensive version. In June 2026 Czech police described a woman who was promised a payout from a supposed investment account over WhatsApp. The scammers sent her 35 QR codes. She believed each scan and approval would send money to her. In fact, every approval sent a payment from her own account – almost 423,000 Czech crowns in total. The same pattern shows up when selling things online: a "buyer" sends a code that leads to a fake bank page.
4. QR codes for "linking a device"
Messaging apps such as Signal and WhatsApp let you connect your account to a computer by scanning a QR code. In February 2025 SK-CERT, Slovakia's national security team, warned that attackers abuse this in Signal: they disguise the code as a group invitation, a security alert or pairing instructions. When the victim scans it, their account is linked to the attacker's device, which can then read their messages in real time. SK-CERT advises checking your list of linked devices regularly and removing any you don't recognise.
How to check a QR code before you open it
- Read the address. Your phone's camera shows the address before you open it. The domain is what counts – see how to spot a fake link. The FBI points out domains with a typo or a single swapped letter.
- Check physical codes with your eyes and fingers. A sticker over the original code, uneven edges, a code stuck over printed text – these are the signs the FBI lists.
- Don't download apps from QR codes. Find the app in your phone's app store under the company's name. The FBI also advises against installing third-party QR scanner apps – your camera already has one.
- Avoid paying through a site opened from a QR code. Type the operator's address yourself or use its official app, a card or cash (FBI).
- Don't approve anything in your banking app you don't understand. Read what's on screen: an outgoing payment, an amount, an unfamiliar account. If in doubt, don't approve it and call your bank.
- Check codes from people you know another way. If a QR code seems to come from a friend, call them or message them somewhere else (FBI).
Already scanned it?
- You approved a payment: minutes matter. Call your bank's fraud line (the number is on your card and in the app), ask them to block online banking and try to stop the payment.
- You entered a login or card details: follow what to do after entering details on a phishing site and freeze the card in your banking app.
- Someone then calls you "from the bank": hang up and call the official number yourself – see bank impersonation scam calls.
- You scanned a code to link a messaging app: open the list of linked devices in the app's settings and remove any you don't recognise (SK-CERT).
Where to report a fake QR code
- A sticker on a parking meter or charger: tell the operator (contact details are usually on the machine) and the local police.
- A code in a text message: in the UK and the US, forward the text to 7726. The NCSC also explains how to report scam emails and websites in the UK. For a suspicious address, our link checker prepares a short report you can copy.
- You lost money: your bank first. In the US, also report it to the FTC at ReportFraud.ftc.gov and to the FBI at ic3.gov.
"Scan to get paid" codes are typical of investment scams and fake online shops and marketplace sellers – those guides show how to spot the scam from the start.
FAQ
Can a QR code harm my phone just by scanning it?
Scanning with your camera only reads the text inside the code. The danger is what you open or approve next: a page asking for a login or card details, an app to install, or a payment in your banking app. Read the address your phone shows before you open it.
How do I spot a tampered QR code on a parking meter?
Look for a sticker placed over the original code or over other printed text, uneven edges, and a code that leads to a different domain from the operator's. The FBI and the FTC have both warned about this. If in doubt, pay by card, cash or the operator's official app.
A buyer sent me a QR code so I can receive payment. Is that normal?
No. To receive money, all a buyer needs is your account details. Codes like this lead to fake bank pages or to a payment going the other way. Czech police described a woman who scanned and approved 35 such codes and lost almost 423,000 Czech crowns.
I scanned a QR code and approved a payment. What now?
Call your bank's fraud line straight away, ask them to block access to your online banking and try to stop the payment. Then report it: in the US to the FTC and the FBI's IC3, in the UK to your bank and the police.
How can I see where a QR code goes without opening it?
Take a photo or screenshot of it and put it into our link checker. Your browser reads the code itself and the image never leaves your device. Only the address is sent to our server, and only when you click the check button.
Sources
- FBI IC3 – Cybercriminals Tampering with QR Codes to Steal Victim Funds (18 January 2022)
- FTC – Scammers hide harmful links in QR codes to steal your information (6 December 2023)
- Czech Police – fraud using 35 QR codes (South Bohemia, 23 June 2026, in Czech)
- SK-CERT – Warning about compromised Signal accounts (21 February 2025, in Slovak)
- NCSC (UK) – Report a scam text message
- FTC – How To Recognize and Report Spam Text Messages
Spotted a mistake? Let us know and we will correct it openly.
Related
Guide
I sent a photo of my ID to a scammer: what to do now
Scammers ask for a copy of your ID under all sorts of pretexts: “identity verification” for a loan, a flat you want to rent, a prize you've supposedly won, a job offer or a message that claims to be from a government agency. If you've already sent it, money won't vanish from your account because of the photo alone. But a document image with your name, date of birth and document number can be used to open credit or accounts in your name, and makes the next scam aimed at you far more convincing. Here's what to do, step by step.
Guide
SIM swap scam: your phone suddenly has no signal – what to do
Your phone suddenly shows “No service” or “SOS only”, maybe right after someone called claiming to be your mobile carrier and asked for a code from a text message. That's the classic sign of a SIM swap: a criminal has moved your phone number to a SIM or eSIM they control. From then on, your calls and verification texts go to them – including codes from your bank and email. The FBI's Internet Crime Complaint Center received 1,611 SIM swapping complaints in 2021 alone, with more than $68 million in losses. Here's how to spot it, what to do in the first minutes and how to protect your number.
Guide
A "hotel" message asks you to verify your card or pay a balance: how to spot the scam and what to do
The message knows your name, your dates and your booking number. It says your payment failed, or that the reservation will be cancelled unless you verify your card within the hour. It can still be a scam – and police have described travellers who lost thousands this way. Here's how to tell, and what to do if you've already entered your card.