A QR code scam tricks people into visiting fake websites, sharing sensitive information, or sending money to the wrong recipient. Scammers can hide fraudulent links behind QR codes placed on parking meters, restaurant menus, letters, emails, and text messages.
QR codes make everyday tasks easier. However, a quick scan can expose your personal information or put your money at risk if the code leads to a malicious website.
In this guide, you will learn how QR code scams work, how to spot suspicious codes, and what to do if you have already scanned one or lost money.
How Do QR Code Scams Work?
A QR code stores information that your phone can read when you scan it. That information may contain a website address, payment details, contact information, or another type of data.
Scammers take advantage of this convenience by directing people to fraudulent destinations. For example, a code may open a fake banking login page designed to steal passwords. Another may direct a cryptocurrency payment to a wallet controlled by a scammer.
The FBI has warned consumers about malicious QR codes used to direct victims to fraudulent websites and steal personal or financial information. Read the FBI’s guidance on QR code scams.
The main risk is not the QR code’s appearance. Instead, it is the destination or action that the code leads to.
Common Types of QR Code Scams
QR code scams can appear in everyday situations. Knowing where they occur can help you avoid suspicious requests.
1. Fake Parking and Payment Codes
Scammers may place a fraudulent sticker over a legitimate QR code on a parking meter, payment notice, or public sign. When you scan it, you may reach a fake payment website.
Before paying, check the website address and confirm that it belongs to the relevant parking operator or service provider.
2. QR Code Scams Through Emails and Text Messages
You might receive a message claiming that you have an unpaid toll, a delayed package, or a problem with your bank account. The message may ask you to scan a QR code to resolve the issue.
These messages can create a false sense of urgency. Instead of following the instructions, visit the organisation’s official website or contact it through a verified phone number.
3. Fake Refunds and Prize Offers
A caller or online contact may promise a refund, prize, or account credit. They might then ask you to scan a QR code or enter personal information to receive the payment.
Be cautious if someone asks for your banking details, password, verification code, or an upfront payment to release money. Verify the offer independently before taking action.
4. Cryptocurrency QR Code Scams
Cryptocurrency transactions often use QR codes to display wallet addresses or payment requests. Unfortunately, scammers can replace legitimate payment codes with their own.
If you scan a code and send cryptocurrency to the wrong address, the transaction may be difficult or impossible to reverse.
Always verify the recipient’s wallet address and payment amount before confirming a transaction. Never rely solely on the label or message attached to a QR code.
You can also read our guide to Bitcoin ATM scams to learn about related cryptocurrency payment risks.
How to Recognise a Fake QR Code
Not every unfamiliar QR code is fraudulent. However, certain warning signs deserve your attention.
Look for these signs before scanning or making a payment:
- Unexpected stickers: A QR code appears to cover another code on a parking meter, payment terminal, or public sign.
- Suspicious website addresses: The destination contains misspellings, unusual domains, or a web address that does not match the organisation.
- Urgent payment demands: A message threatens account suspension, penalties, or missed deliveries unless you act immediately.
- Requests for sensitive information: The destination asks for passwords, banking details, or authentication codes without a clear reason.
- Unverified cryptocurrency payments: The code displays a wallet address that you have not independently confirmed.
- Unexpected downloads: The destination asks you to install an unfamiliar application or file.
A secure connection alone does not prove that a website is legitimate. Fraudulent websites can also use HTTPS.
When in doubt, do not proceed. Open the organisation’s official website manually or contact its support team using verified contact details.
What to Do After a QR Code Scam
If you have scanned a suspicious QR code, act according to what happened next. Scanning a code alone does not necessarily mean your money or personal information has been compromised.
Step 1: Stop Interacting With the Website Containing the QR code scam
Close the suspicious page. Do not enter additional information, download unfamiliar files, or approve unexpected requests.
If you installed an application from the link, review your device’s security settings and remove the suspicious application where appropriate.
Step 2: Secure Your Accounts
If you entered a password, change it immediately through the service’s official website or application. If you reused that password elsewhere, change it on those accounts as well.
Enable multifactor authentication where available. If you provided banking details or card information, contact your bank or card issuer using a verified number and explain what happened.
Step 3: Contact Your Bank or Payment Provider
If you made a payment, report the incident as soon as possible. Ask whether the transaction can be stopped, disputed, or otherwise addressed.
Keep any reference numbers and written communications. Although a refund is not guaranteed, acting quickly may improve your options.
Step 4: Preserve Evidence
Save the information that may help explain the incident, including:
- Screenshots of suspicious messages and websites.
- The original QR code or a photograph of the sticker.
- Transaction receipts and payment confirmations.
- Cryptocurrency wallet addresses and transaction IDs.
- Relevant emails, phone numbers, and dates.
Do not delete messages or records that could help an investigator or reporting authority understand what happened.
Step 5: Report the Incident
Reporting a scam can help the relevant authorities identify suspicious activity and advise you on the next steps.
Depending on your location and the type of fraud, you can report the incident through these official resources:
- FBI Internet Crime Complaint Center (IC3) — for eligible internet crime reports in the United States.
- Federal Trade Commission (FTC) — for reporting fraud in the United States.
If you live elsewhere, contact your local police or the appropriate national cybercrime reporting authority.
Can You Recover Money Lost to a QR Code Scam?
Recovery depends on how the payment was made, where the money went, how quickly the incident was reported, and what evidence is available.
For example, a bank or card payment may have different dispute options from a cryptocurrency transfer. Contact the relevant financial institution or payment provider promptly to discuss your available options.
For cryptocurrency transactions, a transaction ID and the recipient’s wallet address can help establish where funds were sent. Blockchain analysis may also help trace subsequent transactions when the relevant data is available.
However, tracing funds does not automatically mean that they can be recovered. Recovery may depend on the circumstances, the destination of the funds, applicable laws, and cooperation from relevant service providers or authorities.
At Cipher Tracing, an initial review can help assess the available transaction information and identify possible next steps. Learn more about our crypto recovery services or report a scam to provide details about an incident.
Never share your wallet’s seed phrase, private keys, passwords, or authentication codes with someone claiming to investigate a transaction. Be especially cautious of anyone who guarantees recovery or demands an upfront fee without clearly explaining the service.
How to Protect Yourself From QR Code Scams
You can reduce your risk by following a few simple precautions.
- Inspect QR codes in public places for signs of tampering.
- Preview the destination address before opening a link.
- Type the official website address yourself when dealing with banks or payment providers.
- Verify payment details independently before sending money.
- Keep your phone’s operating system and security software updated.
- Avoid installing applications from unfamiliar websites.
- Be cautious of unexpected messages that demand immediate action.
- Contact the organisation through a trusted channel if a request seems unusual.
These precautions cannot eliminate every risk, but they make it harder for scammers to exploit your trust.
Final Thoughts
A QR code scam can lead to stolen login details, fraudulent payments, or cryptocurrency losses. Fortunately, checking the destination, verifying payment requests, and protecting your account information can reduce your exposure.
If you have already lost money, preserve the available evidence and contact your bank, payment provider, or relevant reporting authority promptly. For cryptocurrency incidents, transaction details may help establish where the funds moved, although tracing does not guarantee recovery.
If you need help reviewing a suspected cryptocurrency scam, visit Cipher Tracing’s crypto recovery services page to learn more about the assessment process.
