QR Code Scams: How Fake Codes on Parking Meters, Emails and Texts Steal Logins and Payments

By Web Asset House Studio · October 29, 2026

Note: Some future links on this site may be affiliate links. We never claim hands-on testing; guides are researched from the public sources listed in each article.

How we wrote this: A summary of the FTC consumer alert "Scammers hide harmful links in QR codes to steal your information," the FTC's phishing guidance and the FBI's public service announcement on tampered QR codes (all linked below), checked October 29, 2026. This is general information, not security certification advice.

QR codes are everywhere: restaurant menus, parking meters, event tickets, boarding passes, invoices. That convenience is exactly what scammers count on. A QR code hides its destination until you scan it, so a fake one can send you to a look-alike login page, a fake payment form, or malware, and you won't see the warning signs you'd notice in an ordinary link.

How the scams work

Stickers over real codes. The FTC reports scammers covering QR codes on parking meters with codes of their own. The FBI describes the same trick more broadly: criminals tamper with physical and digital codes so a scan leads to a malicious site that asks for login and financial information, or redirects a payment meant for a real business.

Codes sent to you. Scammers also send QR codes by email or text with a made-up reason to scan. The FTC lists the usual stories:

a package couldn't be delivered and you need to reschedule
there's a problem with your account and you need to confirm your information
there's suspicious activity and you need to change your password

The FBI adds a business-flavored version: an email saying a payment failed at a company you recently bought from, and that you can only finish the payment by QR code.

These are the same stories used in ordinary phishing. The FTC's point is that they're built to create urgency so you scan without thinking.

What a bad code can do. According to the FTC and FBI, a malicious QR code can take you to a spoofed site that steals what you type, install malware that steals information (the FBI mentions location, personal and financial data), or send your payment to the criminal. The FBI also warns that law enforcement can't guarantee recovering money once it's transferred.

Before you scan: the checklist

From the FTC's and FBI's tips:

Look at the code itself. On a sign, meter or poster, check for a sticker placed over the original.
Read the web address your camera shows before opening it. If it looks like a site you know, check for misspellings or a swapped letter.
Don't scan codes in emails or texts you weren't expecting, especially if they urge you to act now. If the message might be real, contact the company using a phone number or website you already know, not one from the message.
Don't pay through a site you reached by QR code. The FBI recommends typing a known, trusted web address to make the payment instead.
Be careful entering any login, personal or financial details on a site you reached from a code.
Don't download apps from a QR code. Use your phone's official app store.
Don't install a QR scanner app. The FBI says it raises your malware risk, and most phones already scan codes in the built-in camera app.
Got a code from someone you know? Check with them through a number or address you already have.

Protect the phone, too

The FTC's broader advice applies here: set your phone to update its software and apps automatically, use a passcode of at least six digits, and protect accounts with strong passwords and multi-factor authentication, so a stolen password alone isn't enough. See passkeys explained and back up your phone.

If you're a business that uses QR codes

The FBI's warning cuts both ways: if your customers pay through a QR code on a sign or invoice, a criminal can replace your code with theirs. Check printed codes regularly for stickers, and tell customers on the same sign or invoice the exact web address they should land on, so they can compare.

If you scanned a bad code

Entered a password? Change it right away on the real site (typed in yourself), and anywhere else you reused it.
Gave card or bank details, or paid? The FTC says to contact the company you used to pay immediately, report the fraud and ask to reverse the transaction. Its page What To Do if You Were Scammed covers each payment type.
Gave your Social Security number or other ID details? Go to IdentityTheft.gov for steps based on what you lost, and consider a credit freeze.
Think something installed? Update your security software and run a scan, as the FTC advises.

Where to report

The FTC: ReportFraud.ftc.gov
The FBI, if you lost money: IC3.gov or your local FBI field office
A scam text: forward it to 7726 (SPAM); a phishing email: the FTC says to forward it to the Anti-Phishing Working Group at reportphishing@apwg.org