QR code scams all work the same way: the code hides an address you would never click if you could read it. The scammer's job is to put that code somewhere you expect to see one, a meter, a menu, a parcel notice, an email, and to make the page it opens look ordinary. Here are the eight versions you are most likely to meet, what each one looks like, and the one or two details that give it away.
Why do QR code scams work so well?
A link in a text or an email can be read before you tap it. A QR code cannot. You see a square of dots, you scan it, and only then does your phone show where it goes, usually for a second or two before you tap through. Scammers also know that people scan codes in a hurry: at a meter with a queue behind them, at a table when the server is waiting, at the door with a parcel in hand.
The second reason is that the scam moves you from a device with protections to one with fewer. Company laptops filter links; personal phones mostly do not. A code printed in a PDF or an email gets you to pick up your phone, and the phone opens the page without asking the mail filter.
The 8 most common QR code scams
1. The parking meter sticker
A printed sticker with a code is placed over the real code on a parking meter, pay station or electric vehicle charger. Scanning it opens a payment page that copies the operator's design and takes your card number. Cities from Austin to San Antonio have issued warnings about this one.
The tell: the code is a sticker, not printed into the sign, and its edge lifts or sits at an angle. Pay through the operator's app, or type the address printed on the meter yourself.
2. The menu or table sticker
Restaurants and cafés put codes on tables for menus and ordering, so a sticker with a different code looks normal. The fake opens a copy of an ordering page and asks for card details before you have seen a menu.
The tell: a real menu never needs your card to show you the food. If the "menu" wants payment details first, ask a member of staff.
3. The parcel notice
A text, an email or a card through the door says a delivery failed and shows a code to "reschedule" or "pay a small redelivery fee". Scanning it opens a page in the carrier's colors that asks for your address, card and sometimes your date of birth.
The tell: carriers do not charge redelivery fees through a code, and a real notice has a tracking number you can type into the carrier's own site. Go there directly.
4. The fine, toll or tax notice
A letter or text claims you owe an unpaid toll, a parking fine or a tax refund, and the code is the "quick way to settle it". The page asks for your card and often your driving licence or ID number.
The tell: urgency plus a payment request. Real agencies give you a reference number and a way to check on their own website. Look the agency up and check there.
5. The sign-in code in an email or PDF
An email, usually styled as a Microsoft 365, DocuSign or HR message, asks you to scan a code to "verify your account", "view a secure document" or "reset your password". The code is inside the email or an attached PDF so that mail filters cannot read the link. The page is a copy of your company's sign-in screen. Our glossary has a short definition of quishing if you need one for training.
The tell: a company does not need you to scan a code to sign in to something you already use on that device. Open the service from your bookmarks instead.
6. The investment, refund or crypto code
A "customer service" caller, a social media post or a message on a dating app sends a code to receive a refund, unlock a prize or make a "guaranteed" investment. The code opens a wallet page or a cryptocurrency ATM instruction that moves your money, not theirs.
The tell: no genuine refund ever requires you to send money or scan a code at a cash machine. Hang up and call the company on a number you find yourself.
7. The charity or tip-jar sticker
A code on a café counter, a lamppost or a street fundraiser's clipboard invites you to tip or donate. Real ones exist, which is why fake ones work. The page is a generic payment form with no charity number and no name you can check.
The tell: a registered charity shows its name and registration number. If the page does not, donate through the charity's own site later.
8. The free gift or prize code
A flyer, a package insert or a card in the post says you have won a gift card or a free product. Scanning the code opens a page that asks for a "small shipping fee" or a sign-in.
The tell: you did not enter anything. Prizes you did not enter for are not prizes.
| Where the code is | Usually fine | Suspect it when |
|---|---|---|
| Parking meter, charger | Printed into the sign | It is a sticker, or it asks for card details on a page you do not recognize |
| Restaurant table | Printed card, staff know about it | It wants payment before showing a menu |
| Letter, flyer, parcel card | Has a reference you can check on the real site | It is urgent and leads straight to a payment page |
| Email or PDF | Never for sign-in | It asks you to scan to sign in, verify or reset |
| Social or dating message | Rarely | It is about money, refunds or investments |
What should you do if you scanned a scam QR code?
Scanning on its own does nothing: a QR code is text, and your phone only shows you where it leads. The risk starts when you type something in or install something.
- If the page asked for nothing and you closed it, you are fine.
- If you typed a password, change it on the real site now and turn on two-step sign-in. Change it anywhere else you used the same password.
- If you entered card details, call your bank on the number printed on the card and ask them to block the card.
- If you installed an app or a "profile", remove it and run your phone's security check.
- Report the code. Tell the venue or operator so they can remove the sticker, and report the page to your national fraud service. If the code opens an AriaQR short link, anyone can report it at ariaqr.com/report, no account needed.
If you still have the code, a photo or screenshot of it, you can find out what it would have done without opening anything: the QR code safety checker reads it on your device and explains it in plain words, and the QR code reader shows the raw text inside it.
Our guide to checking a QR code before you open it covers the habits that stop most of these in the first second.
What can businesses do about QR code scams?
Your customers will scan your codes with all of this in mind. Make the real code easy to trust and the fake one easy to spot.
- Print the code into the material. A code that is part of the menu, sign or packaging is harder to replace quietly than a sticker.
- Make it look like you. A code built from your own artwork or logo is instantly different from a plain black-and-white sticker. That is one reason brands choose picture codes for public places.
- Land on your own domain. People can read "yourbrand.com" in the preview and relax. Our guide on what a QR code should link to has examples.
- Use codes you can change. A dynamic code points at a link you control, so if a destination is ever compromised you fix it in seconds without reprinting.
- Walk the floor. Scan your own codes every week, and look for stickers over them.
- Tell customers what you never do. "Our codes never ask for card details" on the table card or at the counter is a cheap, strong defense.
How AriaQR keeps the codes it hosts safe
Many of the codes you scan in cafés, hotels and on packaging run on an AriaQR short link, so it is fair to ask what we do about scams on our side. The full list is on our security page; the parts that matter to a scanner are these.
- Every destination is checked. When a link is made or changed, its destination is checked against Google Safe Browsing, and short links and free codes are checked again every day. A flagged link stops redirecting instead of sending you on.
- No links to other shorteners or bare number addresses. Both are refused at creation, because they are the two tricks scammers use to hide a destination behind a destination.
- Reported links warn first. Anyone can report a link without an account. Reported links show a warning page that names the destination until someone has reviewed them, and blocked links never redirect. Our post on short link safety shows what that warning looks like.
- Payment codes are locked. A code that carries a payment can only be changed by the signed-in owner, so a shared screen or a guest session cannot redirect money.
- Scans are not tracked to you. Opening an AriaQR link sets no cookies, your network address is never stored, and the owner sees counts and a map, not people. The detail is in our privacy policy.
If you want to check a code yourself before opening it, the free QR code safety checker reads a photo of it on your phone and explains what it does without opening the link; the link safety checker does the same for a pasted address.
Where to start
If you scan codes, adopt one habit: read the address before you tap, and never type a password or card number on a page a code opened. If you print codes, make them unmistakably yours and point them at a link you control. You can make a code from your own artwork in a minute, verified before download, and see pricing when you are ready.