QR code scams: how to check a code before you scan it

Dayo parks his car outside a clinic. The meter has a sticker that says “Scan to pay.” He scans it, types in his card number and drives off. Two days later his bank calls about a charge he never made.

The sticker was fake. Someone had put it right over the real one.

A QR code is a link you cannot read. That is the whole trick. Here is how to check one in ten seconds.

Where do fake QR codes show up?

Anywhere a real one could. Look out for these:

• Parking meters and pay stations. A sticker is placed over the real code. New York City’s transport department warned about exactly this, and police in other US cities have too.
• Posters and flyers. “Scan to win” or “Scan for the job form” on a lamp post or notice board.
• Paper letters and invoices. A “your parcel could not be delivered” card, or a bill that says “scan to pay now.”
• Emails with a code in them. A picture of a code in an email can slip past filters that only look for links.
• Menus, car parks and event signs. Any place people are used to scanning without thinking.

The FBI’s Internet Crime Complaint Center first warned about this in a public service announcement on tampered QR codes. The message has not changed: criminals swap or fake the code, and you land on their page instead of the real one.

What is the 10-second check?

Look, read, decide. You do it before you open anything.

How do you read the address safely?

Find the first single slash. The real owner of the page is the name just before it.

• pay.larkfieldparking.example/start belongs to Larkfield Parking.
• larkfieldparking.example.pay-now.example/start does not. The real owner is the last part before the slash: pay-now.example.
• larkfie1dparking.example uses the number 1 in place of a letter l. That is a copy.

If the banner on your phone cuts the address short, do not open it. Our guide on how to spot a fake email shows more lookalike tricks, and they work the same way for QR links.

A good habit for parking: use the city’s own app, or the number on the meter itself. If the code is the only way to pay and it looks stuck on, ask a person at the car park.

Why do people fall for it?

Because it feels like a normal moment. You are in a rush. The code is right there. Nobody expects a sticker to be a trap.

Scammers also like QR codes because your phone has no email filter and no “hover to see the link” button. You see the page only after you open it.

What if you already scanned it or paid?

Do not feel bad. Do these in order. Speed matters more than pride.

1. Close the page. Do not type anything more.
2. Paid with a card? Call your bank on the number on the back of your card. Ask them to block the card and dispute the charge.
3. Typed a password? Change it now on the real site. If you used that password anywhere else, change those too.
4. Typed a work login, or scanned at work? Tell IT right away. Our steps for what to do after clicking a phishing link apply here too.
5. Report it. In the US, use ReportFraud.ftc.gov or IC3.gov. In Nigeria, tell your bank, and tell the car park, shop or office that owns the sign so they can remove it.
6. Take a photo of the sticker before you peel it off, if it is safe to do. It helps whoever investigates.

What should staff do at work?

• Scan only codes you expected.
• Never sign in to a work account after scanning a poster, sticker or paper letter.
• If a code is on a notice board in your building and you do not know who put it there, tell facilities or IT.
• Tell IT about any fake sticker you see. It protects the next person.

Keep reading

Two other ways scammers reach you on a phone are covered in the sign-in prompt you did not ask for, and the fake login page and AI voice scam calls from the boss, the bank or family. For a wider look at texts and codes, see smishing and QR code scams: how to train staff.

Try it safely

Reading about it helps. Practice helps more. Our free phishing test sends your team safe, made-up phishing emails and shows who clicked and what to fix. You can also see how phishing simulation training works.