QR-Code Scams That Trigger a Call or Fake Payment—And How to Check Them

QR codes are convenient, which is exactly why scammers have started using them. A quick scan can open a website, start a phone call, or launch a payment app before you've had time to think about it. Because the code itself looks harmless—just a black-and-white square—people trust it more than they would trust a typed link or an unknown phone number. That trust is what makes QR-code scams work.

How QR-code scams typically work

Most of these scams follow one of a few patterns:

• Fake parking, toll, or utility notices. A sticker or printed notice claims you owe a fee and provides a QR code to "pay now." Scanning it opens a fake payment page designed to steal your card details.
• Call-back scams. The QR code doesn't open a website at all—it opens your phone's dialer with a number already filled in. Scanning and tapping "call" connects you to a scammer posing as a bank, delivery company, or government office.
• Malicious stickers over real codes. Scammers place a sticker with their own QR code directly on top of a legitimate one, such as on a parking meter, restaurant table, or public poster. You think you're scanning the real thing.
• Phishing disguised as promotions. Flyers, emails, or social media posts offer a "free gift" or "refund" and ask you to scan a code, which leads to a page that asks for personal or banking information.
• Fake delivery or account alerts. A text or email claims a package couldn't be delivered or your account needs verification, with a QR code instead of a normal link—partly because QR codes are harder for spam filters and security software to scan and flag.

Why QR codes are especially risky

A normal link shows you the web address before you click it. A QR code hides that address until after you've already scanned it and your phone has opened the result. This one-step delay is the core problem: you're committing to an action before you can evaluate it. Scammers rely on the fact that most people don't check what a QR code actually points to.

Red flags to watch for

• A QR code that appears to be a sticker placed over another code, especially on public equipment like parking meters, charging stations, or posters.
• Codes on printed notices, flyers, or windshield tickets claiming you owe an urgent payment or fine.
• Any QR code that, once scanned, tries to open your phone app or dialer rather than a website.
• Pressure language: "pay within 24 hours," "final notice," "account will be suspended."
• A payment page that looks slightly off—unusual URL, poor design, or asking for more information than a payment normally requires (like your card PIN or full banking login).
• QR codes received unexpectedly by text or email from someone claiming to be your bank, a delivery service, or a government agency.

How to check a QR code before scanning

You don't need special tools to protect yourself—just a habit of pausing before you scan.

• Use your phone's built-in preview. Most modern phone cameras show a preview of the destination link before opening it. Read the full address carefully rather than tapping it immediately.
• Look closely at the physical code. If it's printed on a sticker that seems to be placed over something else, or looks slightly misaligned with the surrounding material, don't scan it. Ask staff or check the original source if possible.
• Check the web address for mismatches. Scam pages often use domains that are similar to but not the same as the real company's—extra words, unusual endings, or misspellings.
• Never enter payment or banking details on a page you reached only through a QR code unless you deliberately trust the source, such as a code printed on an official invoice you were expecting.
• If the code opens a phone dialer with a number already entered, don't call it. Instead, look up the organization's number independently—through their official website or the number on your card or a past bill—and call that instead.
• Be extra cautious with codes received by text, email, or social media from someone you didn't contact first, even if it looks like a bank, delivery service, or utility company.
• When in doubt, type the organization's known website address manually instead of scanning, or contact them through a channel you already trust.

What to do if you've already scanned a suspicious code

If you scanned a code and it opened a payment page where you entered card details, contact your bank immediately using the number on your card, explain what happened, and ask them to monitor or block the card if needed. If you called a number from a QR code and gave out personal information, treat it the same way you would any phone scam: don't act on anything they told you to do urgently, and verify independently through official channels. If the code came from a sticker on public property, consider reporting it to the building or business owner so they can remove it, and you can also report the scam to your national consumer-protection or anti-fraud authority.

A simple habit that helps

Treat a QR code the same way you'd treat an unfamiliar link: pause, preview, and verify before you act. The scam only works if you skip that pause. Once checking becomes automatic, QR codes go back to being the convenient tool they were designed to be.