QR codes are everywhere now such as restaurant menus, parking meters, package delivery notices, event check-ins, and charity donation appeals. They’re convenient, and that convenience is exactly what scammers are exploiting.
A QR code is just a link. And a link can go anywhere.
Scammers are printing fake QR codes and placing them over legitimate ones on parking pay stations, delivery tracking notices, and public-facing signs. When you scan the code, you’re sent to a convincing fake website that captures your payment information or login credentials.
How QR Scams Work
The most common version involves fake parking meters or pay stations. You scan the code to pay for parking, enter your credit card information on what appears to be the city’s payment portal, and your card data is immediately harvested by a scammer. Your parking ticket arrives anyway. Your bank account gets drained later.
A newer variation arrives in the mail. You receive what looks like a government notice or package delivery slip with a QR code asking you to confirm details or pay a small fee. The code leads to a near-perfect replica of a real government or delivery website.
AI is now being used to generate convincing replica websites at scale including websites that look identical to banks, government agencies, and major retailers. Visual inspection alone is no longer enough.
Warning Signs
- A QR code sticker that appears to be placed over an existing surface
- The website the code leads to asks for payment information immediately
- The URL doesn’t exactly match the organization’s official web address
- Unexpected mail asking you to scan a code and “verify” information
- Any QR code that bypasses a login you’d normally use
How to Stay Safe
- Before scanning any QR code in a public place, check for a sticker placed over the original. Feel for edges. Look for misalignment.
- After scanning, look at the URL before entering any information. Check every character.
- If a QR code leads to a payment page, consider typing the web address manually instead.
- For parking and government payments, use the official app or website directly rather than a QR code.
- If you received a QR code by mail from an organization you do business with, call them to verify before scanning.