QR code scams are one of the fastest-growing tricks criminals use to steal money and personal data in 2026. These scams, often called “quishing” (QR phishing), rely on a simple trick: covering a real code with a fake one, or printing malicious codes on flyers, parking tickets, and packages. Once you scan, you land on a fake site designed to steal your login or payment details.
This guide explains exactly how these scams work, where they show up most often, and how to check a code before you ever open your camera app.
How QR Code Scams Actually Work
A QR code is just a visual link. Your phone reads the black-and-white pattern and opens a web address automatically. That convenience is exactly what scammers exploit.
Criminals print stickers with malicious codes and paste them over legitimate ones. In other cases, they create entirely fake flyers, invoices, or posters with a QR code as the only call to action. Because the underlying link is hidden inside the code, you can’t tell where it leads just by looking at it.
Once scanned, the code usually leads to one of these outcomes:
- A fake login page that steals your username and password
- A payment site that captures your card details
- A malicious app download that installs spyware
- A link that automatically starts a phone call or text to a premium number
Where Fake QR Codes Show Up Most Often
Scammers target places where people scan quickly, without thinking twice. Knowing these hotspots helps you slow down.
Parking Meters and Garages
Fake parking QR stickers have become extremely common. They’re often placed directly over the real payment code, sometimes with matching branding. Drivers in a hurry rarely notice the sticker looks slightly different.
Restaurant Menus and Table Tents
Since many restaurants switched to digital menus, scammers now print counterfeit table cards. These lead to fake ordering pages that ask for payment info before showing any food.
Packages and Delivery Notices
A fake “missed delivery” slip with a QR code is a popular quishing tactic. Scanning it may lead to a phishing page asking you to “reschedule” by entering personal details.
Public Posters and Flyers
Event posters, charity donation flyers, and even government-looking notices sometimes carry tampered codes. Because these appear in public spaces, they feel more trustworthy than they should.
Warning Signs a QR Code Might Be Fake
You can catch most QR code scams by slowing down for a few seconds before scanning. Look for these red flags:
- A sticker on top of another code — check for raised edges, glue residue, or a slightly different print quality.
- Urgent language nearby, like “pay now” or “act immediately.”
- No other payment option offered besides the QR code.
- Poor print quality compared to the surrounding signage.
- Unexpected placement, such as a code taped to a wall with no official branding.
If anything feels off, don’t scan. Use an official app or website instead.
How to Verify a QR Code Before You Scan
Most smartphone cameras show a link preview before opening it. Always read that preview carefully. A legitimate business URL should match the brand you expect, not a random string of letters.
Here’s a quick verification routine:
- Preview the link first — never scan blindly with apps that auto-open URLs.
- Check the domain name for misspellings or extra characters.
- Avoid entering passwords or payment info on a page reached through a QR code, when possible.
- Search for the business’s official app or website instead of trusting the code.
- When in doubt, ask staff or call the company directly to confirm.
These same habits protect you when you’re browsing on public Wi-Fi networks that carry their own security risks. Combining safe scanning with safe browsing habits closes most of the gap scammers rely on.
Protecting Your Devices and Accounts Long-Term
Even careful scanners can slip up occasionally, so it helps to have backup protections in place. Strong account security reduces the damage if a fake QR code ever does capture your credentials.
Consider moving away from reused passwords entirely. Our guide on whether you should switch to passkeys instead of passwords in 2026 explains how this shift can limit what a scammer can do even if they get a login page you accidentally used.
It also helps to keep your hardware current. Older phones sometimes lack the security prompts that warn you about suspicious links. If you’re unsure whether your device is due for an update, read about the risks of using an outdated smartphone for too long.
Home network security matters too, since a compromised phone can be a stepping stone to other devices. Check out our guide on signs that your router is outdated and needs an upgrade to close that gap.
Why QR Code Scams Are Rising in 2026
QR codes became a daily habit during the shift to contactless payments and digital menus. That familiarity is exactly why scammers now favor them. People trust QR codes the same way they used to trust a printed phone number.
At the same time, phishing tactics overall have grown more convincing. Similar deception techniques appear in AI voice cloning scams that target families over the phone, showing how criminals adapt familiar trust signals into new formats. QR codes are simply the visual version of the same playbook.
Physical security devices aren’t immune either. If a scanned code leads to malware, it can sometimes affect connected devices at home, similar to the risks covered in our piece on locking down smart home camera feeds from hackers.
Frequently Asked Questions
What are QR code scams called?
They’re commonly known as “quishing,” a blend of QR and phishing. The goal is the same as traditional phishing: trick you into visiting a fake site or handing over personal information.
Can scanning a QR code alone infect my phone?
Simply scanning rarely causes harm by itself. The danger comes from what happens after: visiting a malicious site, entering credentials, or downloading a fake app.
How can I tell if a QR code sticker was tampered with?
Look closely for raised edges, mismatched print quality, or a sticker that doesn’t quite align with the surrounding sign. When possible, compare it to another location’s code from the same business.
QR code scams thrive on speed and trust. Slowing down for just a few seconds to preview a link, check for tampering, and confirm the source can prevent most of these attacks. Treat every public QR code the way you’d treat an unfamiliar link in an email: worth a second look before you tap.
