The QR Code Scam: Scan, Then Stop

scan first, verify second

The QR code check

The scam is not the code itself; it is the link the code hides. A QR code can point anywhere, including a fake payment page that looks exactly like the real one.

1. Where they show upStickers, packages, ticketsA printed code stuck over the official one at a parking meter, a package note that says scan to find out who sent it, a text claiming a traffic ticket, or any email demanding a scan to confirm or collect.
2. Check 1Where did the code come from?If it arrived in a text, email, letter, or package the parent did not ask for, it is already suspect. Codes on official meters are printed, not stuck on with a sticker.
3. Check 2-3What does the link say, and what does it ask?Read the preview before the page opens: a payment link should name the official service, not a random domain. And no legitimate meter, ticket, or gift note asks for a credit card or password through a scan: that request alone is the tell.
4. The family rule"I do not scan codes that come to me"Codes the parent actively seeks are fine; codes that arrive uninvited are always the trap. If something was already entered, call the card issuer, change passwords, and report at reportfraud.ftc.gov.

Send this Print this

Where the QR scams show up

• Parking meters and signs. Scammers stick a printed code over the official one. The Federal Trade Commission warns that a sticker over the real code can send the parent to a fake payment page that steals card details.
• Unexpected packages. A package arrives with a note that says scan to find out who sent it or how to return it. The FTC's QR package warning covers this exact pattern: the gift is bait and the scan is the trap.
• Texts threatening a ticket. A message claims a traffic violation was recorded and the parent must scan and pay to avoid a fine. The FTC's 2026 alert on this text scam says the citation is fake and the payment page is the fraud.
• Emails and letters. Anything that demands a scan to confirm, verify, or collect is the same trick in a different envelope.

The three checks before any scan

1. Where did the code come from? If it arrived in a text, email, letter, or package the parent did not ask for, it is already suspect. Codes on official meters are printed, not stuck on with a sticker.
2. What does the link say? The phone shows a preview before the page opens. A parking or payment link should name the official service, not a random domain. If the preview looks wrong, close it.
3. Does it ask for payment or a password? No legitimate meter, ticket, or gift note asks for a credit card through a scan. That request alone is the tell.

If the parent already scanned

The damage depends on what the page asked for. If the parent entered a credit card, call the card issuer and report the charge as fraud. If the parent entered a password, change it now, then check the passwords and accounts guide for the full recovery order. Report the scam to the FTC at reportfraud.ftc.gov so the pattern gets tracked. The scam recovery guide has the complete after-scan sequence.

The family rule

Agree on one sentence the parent can repeat out loud: "I do not scan codes that come to me." Codes the parent actively seeks, like the one on the official bus schedule, are fine. Codes that arrive uninvited are always the trap. The family safe word can extend the same rule to calls and texts.

Related guides

• Verify the message independently
• The text from an unknown number
• The fake invoice scam

Sources & verification

This page is checked against the standards in our editorial policy. Reviewed August 2026:

• Federal Trade Commission: Scammers hide harmful links in QR codes to steal your information (retrieved August 2026)
• Federal Trade Commission: Scam alert: QR code on an unexpected package (retrieved August 2026)
• Federal Trade Commission: That text about a traffic violation is probably a scam (retrieved August 2026)

Found an error? Report it: we log and correct material mistakes publicly.

Found an error? Report it.