susQR QR code safety scanner

QR Code Scams: 10 Real-World Examples You Need to Know

From parking meters to package deliveries — these are the QR code scams happening right now and how to spot them before they steal your money or data

⚠️ QR Code Scam Alert

The FBI, FTC, and cybersecurity agencies worldwide have issued warnings about QR code scams. With quishing attacks up 587% since 2023, criminals are exploiting the trust people place in QR codes to steal credentials, payment details, and personal information.

📱 What Are QR Code Scams?

A QR code scam is any fraud that uses a QR code to trick you into visiting a malicious website, making a payment to the wrong person, or handing over personal information. Unlike clicking a suspicious link in an email — where you can at least see the URL — QR codes hide the destination entirely until you scan them.

That's what makes QR code scams so effective: you can't tell a legitimate QR code from a malicious one just by looking at it. The black-and-white squares look identical whether they lead to a restaurant menu or a credential-stealing phishing page.

The technique behind most QR code scams is called quishing (QR + phishing). Below are the 10 most common QR code scams actively targeting people right now.

1. 🅿️ Parking Meter QR Code Scams

The Parking Payment Scam

This is one of the most widely reported QR code scams. The FBI issued a public warning after scam QR stickers were found on parking meters across major U.S. cities including Austin, Houston, and San Antonio.

🔴 How it works:
  1. Scammers print QR code stickers and place them on or near parking meters
  2. The QR code leads to a convincing fake payment page (often mimicking ParkMobile or similar apps)
  3. You enter your credit card details to "pay for parking"
  4. Your payment goes directly to the scammer, and you may also get a real parking ticket
✅ How to protect yourself: Pay directly through official parking apps you download from the app store — not from a QR code on the meter. If you must scan, use susQR to verify the URL leads to the official parking authority domain.

2. 🍽️ Restaurant Menu QR Code Scams

The Table-Top Menu Swap

Post-COVID, nearly every restaurant uses QR codes for digital menus. Scammers exploit this by replacing legitimate menu QR codes with their own.

🔴 How it works:
  1. Scammers visit a restaurant and stick fake QR codes over the real menu codes on tables
  2. Diners scan the code expecting a menu but land on a phishing page
  3. The fake site may ask for personal info to "join the rewards program" or "order online"
  4. Some variants prompt users to download a fake app containing malware
✅ How to protect yourself: Check if the QR code is a sticker placed over another code. Ask staff to confirm the menu URL. A legitimate restaurant menu URL should match the restaurant's website domain.

3. 📦 Package Delivery QR Code Scams

The "Missed Delivery" Scam

You find a notice on your door — or receive a text or email — claiming a delivery couldn't be completed. It includes a QR code to "reschedule" or "track your package."

🔴 How it works:
  1. A card, text message, or email arrives with a fake delivery notification
  2. The QR code links to a site mimicking USPS, FedEx, UPS, or Amazon
  3. You're asked to enter personal details or pay a small "re-delivery fee"
  4. Scammers harvest your name, address, phone number, and credit card details
✅ How to protect yourself: Go directly to the carrier's official website or app to check tracking. Legitimate delivery services will never ask you to pay a re-delivery fee via QR code. Scan the code with susQR if you're unsure.

4. 📧 Email QR Code Scams (Corporate Quishing)

The "Verify Your Account" Email

This is one of the fastest-growing QR code scams, especially targeting employees at businesses. An email arrives — seemingly from Microsoft, Google, or the company's IT department — with a QR code to scan.

🔴 How it works:
  1. A professional-looking email arrives claiming you need to "verify your Microsoft 365 account," "enable MFA," or "review a document"
  2. Instead of a clickable link (which email filters might catch), the email contains a QR code
  3. Scanning takes you to a convincing login page that steals your corporate credentials
  4. Attackers use the stolen credentials to access email, cloud storage, and company data
✅ How to protect yourself: Your IT department will never ask you to scan a QR code to verify your account. If an email contains a QR code with urgent language, report it to your IT security team. Learn more about how this technique works in our quishing guide.

5. 💰 Cryptocurrency QR Code Scams

The Crypto Payment Redirect

Cryptocurrency transactions rely heavily on QR codes for wallet addresses, making them a prime target for scammers.

🔴 How it works:
  1. Scammers replace legitimate cryptocurrency QR codes with ones pointing to their own wallet addresses
  2. In person-to-person transactions, a scammer may show you a QR code for "their wallet" that actually belongs to a third party
  3. Fake crypto investment opportunities include QR codes to "deposit" funds
  4. Once crypto is sent, transactions are irreversible — the money is gone
✅ How to protect yourself: Always verify wallet addresses character-by-character. Never send cryptocurrency based solely on a QR code from someone you don't know. Use trusted exchange apps for transactions, not QR codes from messages or emails.

6. 📶 Fake Wi-Fi QR Code Scams

The "Free Wi-Fi" Trap

QR codes can automatically configure Wi-Fi connections on your phone. Scammers use this to connect you to malicious networks.

🔴 How it works:
  1. A QR code in a hotel, café, airport, or conference promises "free Wi-Fi"
  2. Scanning the code connects your phone to an attacker-controlled network (called an "evil twin")
  3. All your internet traffic passes through the attacker's system
  4. They can intercept login credentials, banking sessions, and other sensitive data through man-in-the-middle attacks
✅ How to protect yourself: Ask staff for the Wi-Fi network name and password directly — don't rely on posted QR codes. Use a VPN when connecting to public Wi-Fi. Avoid accessing banking or sensitive accounts on public networks.

7. ⚡ EV Charging Station QR Code Scams

The Charger Payment Scam

As electric vehicles grow in popularity, scammers are targeting public EV charging stations — placing fake QR codes over legitimate payment stickers.

🔴 How it works:
  1. Fake QR stickers are placed on EV charging stations, covering or mimicking the official payment code
  2. Drivers scan the QR to "pay for charging" and enter credit card information
  3. The payment goes to scammers while the charger doesn't activate (or was never the issue)
  4. Some fake sites also harvest login credentials for charging network accounts
✅ How to protect yourself: Use the charging network's official app (ChargePoint, Electrify America, etc.) downloaded from your app store. Check for sticker overlays on QR codes. If the code seems stuck on rather than printed, don't scan it.

8. 🎁 Survey & Reward QR Code Scams

The "Win a Prize" Scam

Scammers leave flyers, posters, or stickers with QR codes promising gift cards, discounts, free products, or prize drawings in exchange for "completing a quick survey."

🔴 How it works:
  1. A flyer or sticker advertises a "chance to win" or "claim your reward" with a QR code
  2. Scanning leads to a fake survey that asks for progressively more personal information
  3. At the end, you're asked for a credit card number to "pay shipping" for your prize
  4. Your personal details are sold or used for identity theft; the prize never arrives
✅ How to protect yourself: If a prize seems too good to be true, it is. Legitimate companies don't ask for credit card numbers to deliver prizes. Never enter your Social Security number, full address, or financial details on a site reached through a random QR code.

9. 🏠 Rental & Real Estate QR Code Scams

The Fake Listing QR Code

Scammers post QR codes on "For Rent" signs or real estate flyers that lead to fraudulent listing pages designed to collect deposits.

🔴 How it works:
  1. A QR code on a street sign or flyer promises apartment/home details or virtual tours
  2. The linked site shows an attractive listing at below-market rates
  3. You're asked to submit a rental application with personal data (SSN, bank info, employer details)
  4. Some scams demand "security deposits" or "application fees" via wire transfer or crypto
✅ How to protect yourself: Verify rental listings through established platforms (Zillow, Apartments.com). Never pay deposits before seeing a property in person and verifying the landlord's identity. Be suspicious of listings priced significantly below market value.

10. 💝 Fake Charity QR Code Scams

The Donation Scam

During natural disasters, holidays, or viral news events, scammers distribute QR codes for fake charities to steal donations.

🔴 How it works:
  1. QR codes appear on flyers, social media posts, or even door-to-door solicitations for "charitable donations"
  2. The QR code links to a convincing donation page mimicking legitimate charities like Red Cross or UNICEF
  3. Your "donation" goes directly to the scammer's account
  4. Your payment details may be used for additional fraudulent charges
✅ How to protect yourself: Donate through a charity's official website, which you navigate to directly — never through a QR code. Verify charities at CharityNavigator.org or Give.org. Be especially cautious during emotional events when urgency overrides judgment.

🛡️ How to Protect Yourself from QR Code Scams

✅ The QR Code Safety Checklist

Follow these rules every time you encounter a QR code:

  1. Preview the URL first — Use a scanner that shows the destination before opening it. susQR.com checks the URL against 70+ threat databases for free.
  2. Look for sticker overlays — Run your finger over the QR code. If it's a sticker placed on top of another code, don't scan it.
  3. Check the domain — After previewing, verify the URL matches the expected company (e.g., parkmobile.io, not park-m0bile.com).
  4. Never pay via unverified QR codes — Use official apps for parking, EV charging, and other payments.
  5. Don't scan QR codes from emails — Legitimate companies include clickable links, not QR codes. A QR code in email is a red flag.
  6. Be skeptical of urgency — "Scan now or lose access!" is a manipulation tactic, not legitimate communication.
  7. Use HTTPS verification — If the destination doesn't use HTTPS, don't enter any information.
  8. Keep your phone updated — OS and browser updates include security patches against known QR exploits.
  9. Enable two-factor authentication — Even if a scammer steals your password, 2FA prevents account takeover.
  10. Report suspicious QR codes — Notify the business or venue, and report to IC3.gov (FBI).

🔍 How susQR Helps You Avoid QR Code Scams

susQR.com is a free QR code security scanner built specifically to catch the scams described above. Here's what it does when you scan a QR code:

  • URL Preview: Shows you the full destination URL before you visit it
  • VirusTotal Scan: Checks the URL against 70+ antivirus engines and threat databases
  • Redirect Chain Analysis: Follows all redirects to reveal the true final destination
  • Risk Scoring: Gives you a clear Low / Medium / High / Critical risk rating
  • Speed Mode: Real-time camera scanning — point and scan without uploading a photo

It's free, requires no account, and works on any device with a camera or file upload.

🔒 Don't Get Scammed — Scan Smart

Check any QR code for free before you visit it. susQR scans the URL against 70+ threat databases so you know it's safe.

✅ Free • ✅ No account required • ✅ Camera or upload • ✅ Instant results
🚀 Scan a QR Code Now 📚 Learn About Quishing

❓ Frequently Asked Questions About QR Code Scams

Can you get hacked just by scanning a QR code?

Scanning a QR code itself doesn't hack your phone — it simply decodes a URL or text. The danger comes from visiting the URL the QR code contains. If the URL leads to a phishing site or triggers a malicious download, that's where the threat lies. This is why previewing the URL before visiting it (using a tool like susQR) is the most important safety step.

Are QR codes on restaurant tables safe?

Usually, yes — but not always. Scammers have been known to place sticker QR codes over a restaurant's legitimate menu codes. Before scanning, check if the code looks like it's been stuck on over another one. If you're unsure, ask the server to confirm the menu URL or request a printed menu.

Why are QR code scams increasing?

Three factors are driving the surge: (1) COVID-era normalization — people are conditioned to scan QR codes without thinking; (2) mobile limitations — phone browsers show tiny URLs that are hard to verify; and (3) security bypass — QR codes hide URLs inside images, evading email security filters that would catch traditional phishing links. For a deeper technical look, read our complete quishing guide.

How do I report a QR code scam?

In the U.S., report QR code scams to the FBI's Internet Crime Complaint Center (IC3) and the FTC's fraud reporting page. Also notify the business where the scam QR code was found so they can remove it and warn other customers.

Do QR code scams work on iPhones and Androids?

Yes — QR code scams are platform-agnostic. They work by directing you to a website, not by exploiting a software vulnerability. Both iPhone and Android users are equally at risk because the scam targets human behavior, not operating system flaws.

📚 Additional QR Code Security Resources
🏛️ Government Warnings
🔐 Related Articles on susQR
📍 QR Code Scam News by City

See local QR scam reports and protection tips for your city:

New York • Los Angeles • Chicago • Houston • Austin • Miami • Seattle • Denver • All Cities →