QR Code Scam Tactics and How to Spot Them - Knowledge That Protects You
Fake QR Codes on Parking Meters
In 2022, Texas parking meters were found with fake QR stickers overlaid on legitimate ones. Scanning led to convincing payment pages that stole credit card information. Called 'Quishing' (QR + Phishing), this technique exploits QR codes' visual indistinguishability between real and fake. Police advised using official apps or cash instead.
Restaurant Menu QR Code Swaps
Post-pandemic table QR menus are targeted by scammers who overlay fake stickers. Scanning prompts malware app downloads or fake Wi-Fi login pages. Restaurants now counter by engraving QR codes directly into table surfaces and printing official URLs alongside codes for verification.
QR Codes in Fraudulent Mail
Paper mail with QR codes impersonating delivery services, tax offices, or utility companies exploits the trust people place in physical mail. The defense is simple: verify the sender independently by calling their official number or visiting their website directly, rather than scanning the QR code.
Fake Payment QR Code Swaps at Stores
Replacing a store's payment QR code with a fake one that routes payments to the scammer's account. Victims believe they're making a legitimate payment, making the fraud hard to detect.
As a countermeasure, have the store confirm receipt after payment. If the QR code plate looks suspiciously new or is attached with tape, ask staff to verify.
Three Checks Before Scanning
1. Check for sticker overlays by scratching the QR code edge with a fingernail. 2. After scanning, verify the URL matches the official domain before opening. Watch for tricks like '.corn' instead of '.com'. 3. If asked for personal information (credit cards, passwords), stop immediately. Legitimate services rarely request sensitive data via QR code links.
What to Do If You Accidentally Scan One
Even if you happen to scan a suspicious code, in most cases it does not lead to harm as long as you do not enter information on the displayed page. Do not hastily follow instructions; first, close the page. If you have entered an ID, password, or card information, immediately change that password and contact your card company or the service you use. Also check whether any charges or notices you do not recognize have arrived. Noticing early and moving early keeps harm to a minimum. Not bearing it alone, and consulting the appropriate desk, is also an important response.
Convenience and Risk Are Two Sides of the Same Coin
QR codes' greatest strength (instant link access) is also their greatest weakness (no URL preview before access). The solution isn't avoiding QR codes but building the habit of always checking link destinations. This is basic digital literacy, just like verifying email senders before clicking links.