Scam Prevention
QR Code Scams: How Seniors Can Spot a Fake Code Before It's Too Late
Last updated: 2026-07-03
The Answer First: Not Every QR Code Is Safe to Scan
QR codes — those small black-and-white squares you scan with your phone's camera — have become part of everyday life. You see them on restaurant menus, parking meters, event flyers, and even letters that arrive in your mailbox.
Most of them are perfectly safe. But criminals have caught on, and they've started printing their own fake QR codes and sticking them over real ones, or mailing official-looking letters with a QR code that leads somewhere dangerous.
This scam has a name: quishing, short for "QR code phishing." Unlike a suspicious email or text, a QR code doesn't show you the web address before you tap it. You're trusting a picture — and that's exactly what makes it useful to scammers.
This guide explains where these fake codes show up, how to check one before you scan it, and what to do if you've already tapped on a bad link.
Where Fake QR Codes Show Up
Scammers place fake codes wherever people are already in the habit of scanning without thinking twice.
Parking meters and parking lots. This is one of the fastest-growing versions of the scam. Criminals print a sticker with their own QR code and place it directly over the meter's real payment code. You scan it expecting to pay for parking, and instead you're taken to a fake payment page that steals your card number.
Restaurant tables. Many restaurants replaced paper menus with a QR code you scan at the table. A scammer can place a sticker over the real code, sending you to a look-alike site that asks for payment information before you can "view the menu."
Mailed letters. Some scammers send official-looking letters — claiming to be from a delivery company, a government agency, or your bank — with a QR code instead of a phone number or web link. Scanning it takes you to a page designed to steal personal information or install malicious software.
Flyers and posters. Fake codes appear on flyers for community events, charity drives, or "prize giveaways" stuck to community bulletin boards, telephone poles, or car windshields.
Emails and text messages. Instead of a clickable link (which many phones and email programs now flag as suspicious), scammers embed a QR code in the message itself. Since it's an image rather than a link, some spam filters don't catch it.
How to Tell If a QR Code Has Been Tampered With
Before you scan any code in a public place, take five seconds to look at it closely.
Check for a sticker. Run your finger along the edge of the code. A fake code is almost always a sticker placed on top of the original. If you feel a raised edge, or the code looks slightly crooked or a different shade of white than the sign around it, don't scan it.
Compare it to others nearby. If you're at a parking garage or restaurant with multiple meters or tables, glance at a few. If one code looks different in size, position, or print quality than the others, that's a red flag.
Look for official markings. Legitimate parking apps (like ParkMobile or PayByPhone) usually print their logo and a phone number alongside the code. If the code is unbranded — just a plain black-and-white square with no other information — be cautious.
Ask a person. If you're at a restaurant or business with staff nearby, it's completely reasonable to ask, "Is this the correct code for the menu?" or "Can I pay you directly instead of scanning this?" A legitimate business will never mind the question.
What to Check Before You Tap the Link
Here's the most important habit to build: your phone will show you the web address before you open it. Read it.
When you scan a QR code, your camera app displays a small preview of the website address (called a URL) before you tap to open it. This preview is your last chance to catch a scam.
Look for misspellings. A fake parking site might show "parkmobiie.com" instead of "parkmobile.com" — note the extra "i" replacing the "l." Scammers count on you not looking closely.
Be suspicious of unfamiliar endings. Legitimate businesses usually use ".com," ".org," or ".gov" (for real government sites). Web addresses ending in unusual strings of letters and numbers, or that don't match the business name at all, are a warning sign.
Don't trust it just because it looks official. A fake site can copy a company's logo and colors perfectly. The web address in that preview screen is far more reliable than how the page looks once it loads.
If in doubt, don't tap. Close the camera app and go find the parking payment box, ask the restaurant server for a paper menu, or type the company's known website address into your browser yourself instead of scanning anything.
What Happens If You Scan a Fake Code
Understanding what's on the other end helps explain why caution matters.
A fake QR code typically leads to one of three outcomes:
A fake payment page. You're asked to enter a credit card number to "pay for parking" or "unlock the menu." The page looks convincing, but the money goes directly to the scammer, and your card number is now in criminal hands.
A phishing page. You're asked to "log in" to an account — your bank, Amazon, or even your Apple or Google account — to "verify your identity" before proceeding. Anything you type is captured and used to break into your real accounts.
A malicious download. Some codes prompt your phone to download an app or file. This can install malware that reads your text messages, tracks what you type, or gives a scammer ongoing access to your device.
In every case, the scam depends on speed — getting your information before you've had a chance to think it through.
Simple Habits That Keep You Safe
A few small changes to how you use your phone will close off almost every version of this scam.
Never enter payment or login information immediately after scanning a code. If a QR code takes you to a page asking for a credit card or password, stop. Close the browser, and instead navigate to the company's official app or website by typing the address yourself.
Turn on your phone's built-in link-checking feature. Both iPhones and Android phones can warn you about known dangerous websites before they load. On an iPhone, this is part of Safari's "Fraudulent Website Warning" — check that it's turned on under Settings > Apps > Safari. On Android, it's part of Google's "Safe Browsing" feature in Chrome settings.
Use a VPN for an extra layer of protection. A VPN (virtual private network) routes your internet connection through a secure, encrypted server, which can help block connections to known scam and malware sites before they ever load on your screen. NordVPN is simple to set up — you install the app, tap one button, and your connection is protected, whether you're on your home Wi-Fi or the Wi-Fi at a coffee shop or airport.
Affiliate Disclosure: This article may contain affiliate links. If you make a purchase through these links, we may earn a small commission at no extra cost to you. We only recommend products we genuinely believe in. This helps support our work and allows us to continue providing free content.
If You Already Scanned a Suspicious Code
If you've scanned a code and entered payment or login information, don't panic — but act quickly.
1. Close the browser or app immediately. Don't enter any additional information on the page.
2. Call your bank or card issuer. If you entered a credit or debit card number, call the number on the back of your card and explain what happened. Ask them to monitor for or block fraudulent charges. Many banks can issue a new card number within days.
3. Change any passwords you entered. If the fake page asked you to "log in" to an account, change that account's password immediately from a different, trusted device — and turn on two-factor authentication if you haven't already.
4. Watch your statements closely. Check your bank and credit card statements daily for the next few weeks for any charges you don't recognize.
5. Report it. File a report at reportfraud.ftc.gov. If the fake code was on a parking meter or public property, notify the parking authority or property manager — they'll want to inspect other meters and remove the sticker.
The Short Version to Print and Keep
- Check the code for a sticker before scanning — run your finger along the edge.
- Always read the web address preview before tapping — look for misspellings.
- Never enter payment or login details on a page you reached by scanning a code, unless you're certain it's legitimate.
- When in doubt, don't scan — pay in person, ask staff, or type the website address yourself.
- If you scanned a bad code: close the page, call your bank, change passwords, watch your statements, and file a report.
Stay One Step Ahead
QR codes aren't going away — they're too convenient for businesses to give up. But now that you know what to look for, that small black-and-white square doesn't have to be a mystery or a risk. A five-second check is all it takes.
If you found this guide helpful, consider subscribing below for our free weekly security tips — written specifically for adults who didn't grow up with the internet but refuse to be easy targets. One short email a week, plain English, no technical jargon.
A little caution goes a long way. You've got this.
Subscribe to ClearShield Weekly
Get one practical security tip every Tuesday — written for adults 55+, jargon-free, and always free.