Skip to main content
    Step 1 of 7
    Safety & Privacy
    Beginner
    5 min read 7 stepsMay 12, 2026Verified May 2026

    QR Code Scams (Quishing) — How to Spot a Fake QR Code

    Scammers are placing fake QR codes on parking meters, menus, and packages to steal your bank info. Here are the warning signs.

    At a Glance

    Category
    Safety & Privacy
    Difficulty
    Beginner
    Read Time
    5 min read
    Steps
    7
    Topics covered
    qr code
    phishing
    quishing
    scams
    fraud
    ftc

    In this guide (7 steps):

    1. 1.Understand where the scam shows up
    2. 2.Look at the QR code physically before scanning
    3. 3.Preview the URL before opening it
    4. 4.Never enter financial info from a QR-code link
    5. 5.For package deliveries — never scan a QR code from a notice card
    6. 6.When in doubt, type the URL by hand
    7. 7.Report quishing if you encounter it
    1

    Understand where the scam shows up

    ~36s
    Quishing is most common in places where people expect to scan a QR code. Top spots: parking meters (scammers stick fake QR codes over real ones to redirect payment), restaurant tables (fake menus on top of real ones), package labels (fake "delivery problem" QR codes), gas pumps, charity donation boxes, and even concert posters. The fake QR code usually goes to a website that looks like a real parking app, restaurant payment system, or delivery service.

    Warning

    Public places where many strangers see the same QR code (parking lots, gas stations) are the highest risk. Private codes you receive in known emails or printed restaurant menus inside a building are usually fine.

    2

    Look at the QR code physically before scanning

    ~42s
    Before scanning a QR code in public, look at it. Is the QR code printed on the same material as the rest of the sign? Or is it a sticker placed on top? Peel up a corner with your fingernail if it is on a parking meter or sign — if it lifts off easily, it is a sticker that someone placed there. Real QR codes are printed directly on the surface, not stuck on. If you can see a fake QR code covering a real one underneath, walk away and pay another way.

    Quick Tip

    Quick Tip: On a restaurant menu, the QR code is almost always part of the menu printing. If you see a sticker QR code on a card on the table, ask the server if it is theirs.

    3

    Preview the URL before opening it

    ~34s
    When you scan a QR code with your phone, the URL appears at the top before the page opens. Read the URL. Does it match what you expect? A parking meter QR code should go to a website that has the city name or the parking company name (like meter.lacity.org or parkmobile.io). If it goes to a strange site you have never heard of (some random word.com or a long string of letters), do NOT tap it. Just close the camera app.

    Warning

    Watch out for URLs with extra hyphens, numbers, or unusual extensions: "parkmobile-pay.com" is fake; "parkmobile.io" is real. "amaz0n-delivery.com" is fake; "amazon.com" is real.

    4

    Never enter financial info from a QR-code link

    ~27s
    A real parking meter QR code might take you to a payment page, but be careful — even legitimate sites can be spoofed. Best rule: do not type your credit card number, bank login, or Social Security number into ANY page you arrived at through a QR code. Instead, after scanning, look up the parking company or restaurant on your own through a search engine, type their address into your browser fresh, and pay through their real site or app.
    5

    For package deliveries — never scan a QR code from a notice card

    ~41s
    A common 2025-2026 scam is a yellow "delivery notice" left on your door or in your mailbox with a QR code that says "scan to reschedule." The QR code goes to a fake USPS/UPS/FedEx page that asks for a "small reshipping fee" of $2 — which is just to get your credit card. Real delivery notices from USPS, UPS, FedEx never ask for payment over a QR code. To check a real delivery, go to the carrier's website directly and use the tracking number on the notice.

    Quick Tip

    Quick Tip: USPS Informed Delivery (free at informeddelivery.usps.com) shows you scans of every piece of mail before it arrives. Anything claiming to be a USPS delivery problem that does not show up there is fake.

    6

    When in doubt, type the URL by hand

    ~23s
    If you really need to access the site behind a QR code (say, a real restaurant menu when you have no other choice), do NOT scan. Instead, ask the staff or look at the printed material for the actual website address. Type it into your phone browser. Yes, it is slower. But you cannot be quished by a fake QR code if you do not scan anything.
    7

    Report quishing if you encounter it

    ~27s
    If you spot a fake QR code on a parking meter, sign, or public space, tell the business or property owner so they can remove it. If you actually scanned a fake one and entered any information, change your bank password right away, call your bank to flag the transaction, and report to the FTC at reportfraud.ftc.gov. Also alert friends and family — quishing spreads through neighborhoods, and one warning post can stop the whole block from falling for it.

    You Did It!

    You've finished reading: QR Code Scams (Quishing) — How to Spot a Fake QR Code

    How well did this guide stick with you?

    Need more help? Book a TekSure tech

    QR codes — those little checkerboard squares you scan with your phone — are useful, but scammers have figured out that they look identical to most people. A real QR code on a restaurant menu and a fake QR code stuck on top of it look exactly the same. The fake one sends you to a website that asks for your credit card or login.

    This trick has a name: "quishing" (QR + phishing). The FTC issued a public warning in 2024 because reports of quishing tripled. The good news: a few simple habits stop quishing cold without any apps or software.

    (Sources: FTC Consumer Alerts, consumer.ftc.gov/consumer-alerts/2024/03/scammers-hide-harmful-links-qr-codes-steal-your-information; FBI Public Service Announcement, ic3.gov)

    Rate this guide

    How helpful was this guide?

    qr code
    phishing
    quishing
    scams
    fraud
    ftc

    Official Resources

    FTC Consumer ProtectionCISA — Cybersecurity TipsAARP Fraud Watch Network

    Sources used to create and verify this guide. View all sources →

    ← Previous

    Send and Reply to Text Messages from Your Mac — iPhone and Android

    Next →

    iOS 18 Genmoji — Make Your Own Emoji, the Senior-Friendly Way

    Still stuck? Let a pro handle it.

    A real person can walk you through this over the phone, anywhere in the US. If we can't fix it, you don't pay.

    Book a Verified Tech How It Works

    Learn more from official sources

    Related Guides

    How to Secure Your Home Wi-Fi Network

    Simple steps to lock down your home router, keep strangers off your network, and protect every device in your house.

    3 min read

    Setting Up Two-Factor Authentication (2FA) on Any Account

    Add a second layer of security to your most important accounts. This one change stops most account takeovers cold.

    3 min read

    Staying Safe on Social Media

    How to protect your privacy on Facebook and Instagram, spot fake accounts, and avoid the most common social media traps.

    3 min read