QR Code Scams in 2026: How to Spot a Fake Code Before You Scan

What a QR Code Scam Looks Like

The trick is old phishing wearing a new costume. A fake page asks for the same details a fake email would, except the code hides the address until the phone opens it.

The Sticker Over the Real Code

Weatherproof vinyl costs pennies. A scammer prints a code, covers the legitimate one at a meter or charging station, and collects payment card entries for days.

The Lookalike Payment Page

Logos, fonts, and colors match the real company. The web address does not, which is the one detail forgers cannot fake.

The Passcode Grab

Some fake pages ask for the six-digit code texted by a bank. Handing that over lets a criminal finish a login already in progress on their own computer.

Where Fake QR Codes Show Up

Physical placements dominate, though mailed and emailed codes are climbing fast. Four spots account for the bulk of reports.

Why Older Adults Get Targeted

Fraud reports from the FTC show larger median losses among people over 60, and QR fraud follows the same pattern for three practical reasons.

Small Print, Big Consequences

The address banner appears in tiny gray text for a few seconds. Bumping up text size makes it readable, which our display settings guide walks through.

Urgency Beats Judgment

"Pay within 10 minutes or receive a ticket" pushes anyone to skip the check. Slowing down is the whole defense, a theme running through our staying safe online resource.

Nobody to Ask in the Moment

Standing in a parking lot with a suspicious sticker, there is no family member nearby. TechMaid answers on the spot from the assistant page.

Red Flags Before You Scan

Five signals separate a legitimate code from a trap. Any single one is enough reason to stop.

• Raised edges or a peeling corner. Run a fingernail across the code. A sticker on top of printed material lifts.
• A shortened address. Links starting with bit.ly or tinyurl hide the real destination twice over.
• Extra words in the domain. chase-secure-billing.com belongs to nobody at Chase.
• A request for a one-time passcode. No legitimate payment page asks for the number a bank just texted.
• A prompt to install an app. Legitimate apps live in the App Store and Google Play, never behind a scan.

How to Scan Safely

Scanning is fine as a habit, provided four steps come with it. Each takes seconds.

1. Use the Built-In Camera, Not a Scanner App

Apple and Google both display the destination address before opening it. Third-party scanner apps often skip that step and carry ads.

2. Read the Domain Out Loud

Saying it slows the eye down enough to catch a swapped letter. Check the part right before the first slash.

3. Type the Address Yourself for Anything Involving Money

Bank, Medicare, utility, and delivery accounts deserve a typed address or a saved bookmark. Our online shopping safety guide covers the same rule for checkout pages.

4. Lock Down the Accounts Behind the Card

Strong, unique passwords limit the damage of one bad page. Start with our strong passwords walkthrough, then add two-factor authentication to email and banking.

What to Do If You Already Scanned

Speed limits losses. Work down this list in order, and skip nothing because it feels embarrassing.

Freeze the Card First

Card apps have an instant lock toggle. Call the number printed on the back to replace the number entirely.

Change the Password on Any Account You Entered

Reuse means one stolen password unlocks several accounts. Change matching passwords elsewhere too, and see password recovery help if you get locked out.

Report It

File at reportfraud.ftc.gov and, for money already sent, at ic3.gov. Reports feed the takedown requests that pull fake sites offline.

Watch Statements for 90 Days

Small test charges precede large ones. Turn on transaction alerts so the phone reports each purchase as it happens.

How TechMaid Helps

Scam questions arrive at inconvenient hours, usually with a countdown attached. TechMaid answers in plain language, on the device already in hand.

A Second Opinion in Seconds

Describe the code, the sticker, or the message and get a straight verdict. See how it works for the walkthrough.

Person Support Within 24 Hours

Paid members get a callback from a real person for anything that needs a calm voice, detailed on the pricing page.

Give It to Someone Who Needs It

A TechMaid gift card puts patient help in a parent's pocket before the next sticker shows up. More reading lives on the blog and in our how-to guides.

Sources

Consumer protection agencies and security researchers referenced in this article.

• Federal Trade Commission, consumer alert on scams hiding behind QR codes.
• FBI Internet Crime Complaint Center, public service announcement on malicious QR codes.
• Better Business Bureau Scam Tracker, reports on parking meter and package QR fraud.
• Federal Trade Commission Consumer Sentinel Network, fraud loss data by age group.
• Cybersecurity and Infrastructure Security Agency, guidance on phishing-resistant authentication.

Frequently Asked Questions

Short answers to the questions families ask after a suspicious scan.