QR code scams: parking meters, packages, and emails, and how to scan safely

Key takeaways

A QR code is a web link in disguise. Your camera shows the address before opening it. Read it first.
Stickers placed over real codes on parking meters and signs send people to look-alike payment pages. The FTC issued an alert about this in September 2026.
Be suspicious of QR codes in unexpected emails, texts, letters, and packages, especially ones that lead to a sign-in or payment page.
To pay for parking or a bill, use the official app or type the address printed on the machine.
You do not need a special QR scanner app. The built-in camera is safer.

A link you cannot read

QR codes became part of everyday life through restaurant menus, parking, tickets, and payments. They are convenient for the same reason they are risky: a person cannot read one. You have no idea where it leads until a device decodes it, and most people tap the result without looking.

Criminals use them for exactly that reason. Security researchers call it "quishing", for QR phishing. The technique is simple: get you to scan, send you to a convincing page, collect a password or card number.

Where fake codes turn up

Parking meters and signs

In September 2026 the FTC warned about stickers placed over the real codes on parking meters. Scanning the sticker opens a look-alike payment page that collects card numbers or logins. You lose your card details and, because the real parking was never paid, you may get a ticket as well. The same trick appears on electric vehicle chargers, bike-share docks, and restaurant tables.

Emails at work

"Your password expires today. Scan to keep your account active." "You have a secure document. Scan to view." The code leads to a fake sign-in page. Attackers like QR codes in email because filters that check links often cannot read images, and because scanning moves you from a managed work computer to your personal phone.

Texts and letters

Fake delivery notices, toll demands, and even paper letters that appear to be from a bank or government office, with a code to "verify your details".

Unexpected packages

An item you did not order arrives with a card: "Scan to see who sent your gift." The page asks for personal details or a small payment.

Crypto machines and payment requests

A caller directs you to a crypto ATM and sends a QR code to scan at the machine. That code is the scammer's wallet address. Any instruction to deposit cash into a crypto machine for a bill, a fine, or to protect your money is a scam.

Marketplace and payment apps

"Scan this code to receive your payment." Codes are for sending money or signing in. You never need to scan one to be paid.

How to scan safely

Use your phone's built-in camera. It shows the web address before opening it. You do not need a separate scanner app, and some of those are themselves harmful.
Read the address before tapping. Find the first single slash and look at the two parts before it. That is the real site. Does it match the business? Our guide to reading links takes two minutes.
Look at the physical code. Is it a sticker on top of something? Is it on a surface where anyone could have put it? Does it look different from the others nearby?
Be cautious about what happens next. A menu or a map is low risk. A page asking for a password, a card number, or an app install is where you stop and think.
When money is involved, go direct. Use the operator's official app from your app store, or type the address printed on the machine.
Keep your phone updated, so that known weaknesses are fixed.

For businesses that use QR codes

Print codes as part of the sign or menu, not as stickers, so tampering is visible.
Show the destination address in plain text next to the code, so customers can compare.
Check your codes regularly, especially on unattended machines.
Tell customers how you will and will not ask for payment.

If you scanned and entered details

Card details: call the number on the back of the card, report it, and ask for a replacement. Dispute any charges you do not recognize.
A password: change it on the real site now, and anywhere it was reused. Turn on two-factor sign-in. If it was a work account, tell your IT team immediately. Speed limits the damage and nobody sensible will blame you.
An app was installed: remove it, update your phone, and change important passwords from another device.
Personal details: see freeze your credit and lock down your accounts.
A parking payment: you may still owe the real fee. Pay it through the official route and keep a note in case you need to contest a ticket.
Report it at ReportFraud.ftc.gov, and tell the business or city whose code was covered so the sticker can be removed.

The habit

Treat a QR code as you would a link from a stranger: fine for looking, not for paying or signing in until you have read where it goes. The two seconds your camera gives you to see the address are the whole defense. Use them.

Common questions

Can scanning a QR code hack my phone?

Scanning alone is very unlikely to harm an up-to-date phone. The danger is what you do next: entering a password or card number on a fake page, approving a download, or installing an app. Preview the address, and back out if it is not what you expected.

How can I tell if a QR code on a parking meter is fake?

Look for a sticker placed over another code or over the machine's casing, run a fingernail over it, and compare the web address your camera shows with the operator named on the machine. If anything looks wrong, pay with the official app, by card at the machine, or by typing the printed address.

Why do scam emails use QR codes and not links?

Because many email security filters scan links but not images, and because scanning moves you from a protected work computer to a personal phone. A QR code in an email asking you to re-authenticate, view a document, or update payroll details should be reported to your IT team.

I received a package I did not order with a QR code inside. What is it?

It is likely a variation of a brushing scam. The code may lead to a page that asks for personal details or a payment to find out who sent the gift. Do not scan it. You can keep the item, and you should check your shopping accounts for unauthorized activity.

Official sources and further reading

Published September 21, 2026, last updated September 21, 2026. This guide is general education for people in the United States. It is not legal or financial advice, and it cannot tell you whether a particular message or person is genuine. Spot an error? Tell us.