How to Spot QR Code Scams

Be careful if you scan a QR code. It could be a scam.

Plenty of legitimate businesses and organizations use QR codes to make it easy to share data—from product information to restaurant menus to airline boarding pases—with consumers. However, the Better Business Bureau, Federal Trade Commission and police departments across the U.S. are warning consumers to be on the lookout for fake QR codes that aim to steal their money or personal information.

Because QR codes are so commonplace now, it’s important to be able to spot fakes. Here’s what to know about QR code scams and how to avoid them.

What are QR codes?

A QR (quick response) code is a type of barcode that typically is a black and white square image and can be scanned by a smartphone to process the information in the code. For example, some restaurants now provide customers with a QR code to pull up menus on their phones. Cities are using QR codes for public transportation schedules and on parking meters to make it easy to pay for parking. Companies provide QR codes that consumers can scan to get information about their products, redeem coupons, take surveys and the list goes on.

Plenty of websites offer free QR code generators, making it easy for anyone to create these codes. Because QR codes are so widespread, scammers are using them to steal people’s money and personal information.

How QR code scams work

Scammers typically use QR codes in one of two ways to trick people. They cover legitimate QR codes in public places with codes they have created, or they generate codes that they post online or send to consumers by email or text message.

If you scan a fake QR code, you could be directed to a website that might look like a legitimate site, but it will steal any information you enter. Or QR codes created by scammers could include malware that will infect your device, according to the Federal Trade Commission.

Common QR code scams

These are a few of the most common QR code scams that have been circulating, according to BBB.

• Parking QR code scams: Scammers have been covering QR codes on parking meters, parking machines and parking signs with their own codes in cities across the U.S. When drivers scan the codes to pay for parking, they are directed to enter payment information. Then, they discover that they are charged at a much higher rate or are hit with recurring charges.
• Parking ticket QR code scams: Scammers have been creating fake parking tickets with QR codes to pay fines. The codes direct victims to fake websites where they are prompted to enter personal information and pay fines they don’t actually owe.
• Utility company QR code scams:  Scammers posing as utility companies are contacting consumers and claiming that they have outstanding bills that must be paid immediately to avoid having their utilities shut off. The emails or text messages claim that the payment portal is offline and provide a QR code that consumers can use instead. The code directs people to imposter payment portals.
• Government compliance notice scams: The BBB has received reports from business owners who have received letters notifying them that they have reporting obligations under the “Corporate Transparency Act.” The letters include a QR code, which directs business owners to a fake website.

‍

Scammers also post QR codes on social media sites and use them in a variety of schemes to collect payments, such as cryptocurrency investing scams, romance scams and package delivery scams.

How to avoid QR code scams

Because QR codes are commonly used by legitimate businesses and organizations, it’s hard to avoid them entirely. You can protect yourself, though, by taking these steps whenever you do scan a QR code.

• Check for tampering. If you see a QR code in a public place such as a parking meter, inspect it closely for signs of tampering. Check, in particular, to see if the code is on a sticker that has been placed over another code.
• Don’t scan QR codes in unsolicited emails, text messages or direct messages on social media. Even if the message appears to come from a trusted source, it could be a scammer impersonating a known business or government agency. If you’re being asked to make a payment or provide account information, contact the organization that supposedly is trying to reach you by looking up its phone number online.
• Be wary of urgent requests to use QR codes for payments. Scammers will try to create fear and prompt you to act quickly without thinking by telling you there is a problem that needs your immediate attention.
• Inspect web addresses to which QR codes direct you. Check the url to make sure it matches the name of the company that supposedly provided the code  and has https and a padlock symbol to designate that it is secure. If the url is shortened or you can’t tell whether you’ve been directed to a legitimate site, don’t enter any payment or personal information.
• Don’t download QR code scanning apps. All you need is your phone’s camera to scan QR codes.

‍

If you believe that you are a victim of a QR code scam, alert your financial institution to any payments you made. File a report with local law enforcement, especially if the QR code was in a public place such as on a parking meter. You also could file a report with the FBI’s Internet Crime Complaint Center if you interacted with a QR code sent to you by email, text message or on social media.

‍