Fake QR Code Scams Explained

QR codes have become part of everyday life. People use them to pay bills, access restaurant menus, log in to services, register for events, and verify accounts. Unfortunately, attackers have also discovered that QR codes are an effective tool for phishing and fraud.

Unlike traditional links, QR codes hide their destination until they are scanned. This makes it easier for attackers to trick users into visiting malicious websites.

What Is a Fake QR Code Scam?

A fake QR code scam occurs when an attacker creates or replaces a legitimate QR code with a malicious one. The victim scans the code and is redirected to a phishing page, payment scam, malware download, or other fraudulent destination.

This type of attack is often called quishing, which combines the words QR code and phishing.

Why QR Codes Are Attractive to Attackers

• Users cannot easily see the destination
• Mobile devices encourage quick actions
• QR codes appear trustworthy
• Security awareness is often lower
• Many users expect QR codes to be safe

Attackers take advantage of these assumptions to increase the likelihood that victims will scan and interact with malicious websites.

Common Fake QR Code Scams

Parking Meter Scams

One of the most common QR scams involves parking meters. Criminals place stickers containing malicious QR codes over legitimate payment codes. Drivers scan the fake code and submit payment details to a fraudulent website. See Parking Meter QR Code Scams for how to inspect a sticker and verify the payment destination.

Restaurant Menu Scams

Some restaurants use QR codes for digital menus. Attackers may replace legitimate codes with malicious versions that redirect customers to phishing pages or fake payment portals.

Package Delivery Scams

Victims receive emails, SMS messages, or printed notices containing QR codes that claim to provide shipment updates. Instead, the code redirects users to credential theft pages.

Office Document Scams

Employees receive PDF documents that contain QR codes. The code often redirects to fake Microsoft 365, Google Workspace, or corporate login pages.

Public Poster Scams

Event posters, advertisements, and public notices may contain QR codes that have been altered or replaced by attackers.

How Fake QR Code Scams Work

1. Attacker creates a malicious QR code.
2. Victim scans the code.
3. User is redirected to a phishing website.
4. The website requests credentials, payments, or personal information.
5. The attacker collects the submitted data.

Some campaigns include multiple redirects, URL shorteners, and tracking parameters to make analysis more difficult.

Warning Signs

• QR code appears as a sticker placed over another code
• Unexpected login requests
• Requests for payment information
• Urgent messages
• Unknown domains
• Multiple redirects
• Shortened URLs

QR Codes and Shortened Links

Many QR codes use shortened URLs. This is often legitimate because shorter URLs create smaller and easier-to-scan QR codes.

However, attackers also use shortened links to conceal malicious destinations.

Related guide: QR Code Short Links Explained

How to Check a QR Code Safely

1. Preview the destination URL.
2. Verify the domain.
3. Look for shortened links.
4. Watch for suspicious redirects.
5. Be cautious with login pages.
6. Verify payment requests independently.

If the destination seems suspicious, do not continue.

What to Do If You Scanned a Fake QR Code

If you scanned a QR code and submitted information:

• Change affected passwords immediately
• Enable MFA
• Monitor financial accounts
• Review login history
• Report the incident

Related guide: I Clicked a Phishing Link What Now?

How 2check.click Helps

2check.click allows users to inspect QR code destinations before interacting with them. The platform identifies suspicious domains, hidden redirects, phishing indicators, and risky URL patterns.

Instead of blindly trusting a QR code, users can analyze the destination first and understand the risks in plain English.

Final Thoughts

Fake QR code scams are growing rapidly because they combine convenience with hidden destinations. Attackers know that many people trust QR codes without verifying where they lead.

Before entering passwords, payment details, or personal information after scanning a QR code, inspect the destination and verify that it belongs to the organization you expect.