Member guide · Read a preview, full guide with Personal

QR code scams: how to spot a fake QR code before you scan

How QR code scams work on parking meters, letters, emails and texts, how to check where a code leads before you open it, and what to do if you scanned one and entered details.

Check yourself or someone else

See what’s online about a photo, phone number or email. Check your own to see what others can find, or check someone you’re talking to.

See what’s online about a phone number: yours, or one that’s contacting you.

We look up the number type, carrier and country, and any scam reports from other people. We don’t save what you enter. Up to 10 checks a day.

Got a suspicious email? See where it really came from

Paste the email’s headers to see the real sending server, country and sender checks.

✉️ Check email headers

QR codes are handy for menus, parking and tickets. That convenience is exactly why scammers use them: you can’t see where a code leads until you scan it.

How QR code scams work

  • Stickers over real codes. The FTC reports scammers covering QR codes on parking meters with their own (FTC).
  • Codes in emails and texts. A message claims a missed delivery, a problem with your account or suspicious activity, and asks you to scan to fix it (FTC).
  • Codes in letters and parcels. The US Postal Inspection Service warns about codes sent by mail and on unexpected packages (USPIS).

The code leads to a spoofed site that looks real. Anything you type there, such as a login or card number, goes to the scammer.

Unlock the full guide with ImposterWatch Personal, US$9/mo

Members read every guide in full, plus get breach and dark web alerts for up to three email addresses, an AI-powered romance scam check every month, and account recovery help.

Get Personal, US$9/mo Already a member? Log in

Not ready? Get scam alerts

Signing up doesn’t unlock this guide. See our privacy policy.

How to check a QR code

  1. Look at the code itself. On a sign or meter, feel for a sticker layered on top, lifted edges or a code that looks out of place.
  2. Read the address before opening. Most phone cameras show the web address first. Check for misspellings or swapped letters (FTC).
  3. Be wary of short links. A shortened address hides the real destination.
  4. Check the site. Paste the address into our website check, or read how to check if a website is fake.
  5. Go direct. For parking, tolls or deliveries, use the official app or type the address yourself.

If you scanned a code and entered details

  1. If you paid, call your bank on the number on your card.
  2. Change the password you entered, and anywhere you reuse it, and turn on two-step sign-in (FTC).
  3. Update your phone’s software.
  4. See what to do if you gave a scammer your information.

Where to report

Questions

What is quishing?

It’s phishing using a QR code: the code leads to a fake website that asks for logins, card numbers or a payment.

Can scanning a QR code hack my phone?

The FTC says a scammer’s code could lead to a spoofed site or install malware. Keeping your phone updated and not installing apps from a code link lowers the risk.

Are restaurant and parking QR codes safe?

Most are genuine, but the FTC has warned about fake codes stuck over real ones on parking meters. If in doubt, pay through the official app or at the machine.

Why would a scammer use a QR code instead of a link?

A code hides the web address until you scan it, and it can slip past email filters that check links.

Scanned a code and not sure about the site?

Check the website with the site check before you enter anything. ImposterWatch Personal (US$9/month, cancel anytime) adds AI-powered checks, breach alerts for up to three email addresses and account recovery help.

Check a websiteGet Personal, US$9/mo

More guides

General information only, not legal or financial advice. ImposterWatch is operated by Cloud Investments FZE (UAE) and is not a background check or private investigator service.