A QR code is just a web link in image form. That makes it convenient, but it also lets scammers hide a dangerous or fake address behind a harmless-looking square.
Does this affect you?
Use this before scanning QR codes with an iPhone or Android camera in public places, emails, texts, mail, flyers, parking signs, restaurants, or package notices.
Spot a fake QR code before scanning
A few seconds of checking can prevent a phishing page from opening.
- Look for a sticker placed over a real code, especially on parking meters, payment signs, restaurant menus, public notices, and flyers. Misaligned edges or different print quality are warning signs.
- Preview the web address before opening it. Most phone cameras show a link preview; read it before tapping.
- Avoid shortened links and domains that do not match the expected company, city, restaurant, parking provider, or delivery service.
- Be extra careful with QR codes in unsolicited emails, texts, postcards, or flyers, especially those tied to package issues, prizes, account problems, or payments.
- Watch for urgency such as scan now to avoid a fee or scan to stop your package from being returned. That is standard phishing pressure.
- Be suspicious if scanning immediately leads to a login or card-entry page. Use the official app or website instead when possible.
If you already scanned and tapped through
The risk depends on what happened after the scan.
- If you only opened a webpage and entered nothing, close the tab. Avoid downloading anything it offered.
- If you entered a password, change it on the real site and anywhere else you reused it.
- If you entered payment details, contact the card issuer or bank immediately.
- If you installed an app or profile, remove it. On iPhone, check Settings > General > VPN & Device Management for unfamiliar profiles.
- Run a security scan if you downloaded or installed anything.
- Report the incident at reportfraud.ftc.gov. If the fake code was on public property, tell the business, city, or property owner so it can be removed.
More control
Parking QR codes deserve extra care
Fake stickers over legitimate parking payment signs have appeared in U.S. cities. If a parking code looks off, use the official parking app, website, or kiosk instead.
Restaurant menus are usually legitimate
Most restaurant QR menus are normal. If a table code opens a login, payment, or strange domain instead of a menu, tell staff.
Use the built-in camera
Third-party QR scanner apps are unnecessary and may add tracking or ads. The built-in iPhone and Android camera scanner is the safer default.
Sources
- FTC Consumer Advice – Scammers Hide Harmful Links in QR Codes (2025)
- FBI – Malicious QR Codes (2025)
- Better Business Bureau – QR Code Scams (2025)