QR code scams: how to spot them and what to do

A QR code is just a link. Read it before you trust it.

The answer in 2 lines. A QR code is a link you can't read with your eyes. It can take you to a fake site, just like a link in a scam text. Be wary of a code stuck on top of another one (parking meter, pay station, poster) and of a code in a letter, email, text or package you weren't expecting. Before you open anything, read the web address your phone shows. To pay for parking or a ticket, use the official city app or a website you type in yourself.

The first 4 steps

Look at the code itself: a sticker placed over another code, crooked, peeling or on the side of a meter is a red flag.
Read the web address your phone shows before you open it. The FTC says to look for misspellings or swapped letters that imitate a real site.
To pay for parking, use the city's official parking app, pay at the meter, or type the city's website address yourself.
Don't enter anything (card number, login, password) on a page you reached through a code you're not sure about.

Where fake QR codes show up

Where	The trap
Parking meters and pay stations	A sticker sends you to a fake parking payment site that takes your money, your card details or both.
Letters, texts and emails that look official	A fake parking ticket, court notice, package problem or "suspicious activity" alert tells you to scan and pay right away.
Packages you didn't order	A note with a code "to find out who sent it" or "to process a return" can lead to a phishing site or malware.
Bills and payment requests	Fake utility "barcodes" or codes that push you to pay by cryptocurrency.
Posters, flyers, menus	A link to a fake deal or an app you shouldn't install.

What not to do

Scanning a code in a letter, text or email you weren't expecting, even with a familiar logo. If it might be real, contact the company or agency using a number or website you already know.
Thinking a QR code is safer than a link: it's the same thing, just harder to read.
Downloading an app suggested by a code taped up in the street.
Paying a ticket or fine through a code you received: go to the court's or city's official site yourself.

If you scanned, paid or typed something in

You entered a card number: call your card issuer or bank right away, using the number on the back of your card, to block the card and dispute the charge. See Lost or stolen card: how to block it fast.
You entered a password: change it right away, along with any other account that uses the same one, and turn on two-factor authentication.
You installed an app: delete it and update your phone's software.
Check your statements for charges you didn't make, and don't reply to the fake site or anyone who contacts you through it.
Report it to the FTC at ReportFraud.ftc.gov: choose the type of problem, then follow the questions. Also tell whoever runs the meter or place (city parking office, property manager) so they can remove the sticker.
For the full checklist, see I clicked a scam link: what now?

In your city

New York City: in June 2025, NYC DOT warned about fake QR code stickers on parking meters. Pay only through the official ParkNYC app or at the meter. If you see a sticker, report the meter location to the city by calling 311 (NYC DOT advisory). If you paid, tell your bank and report it to police.
Boston: in March 2026, Boston Police warned about fake parking violation notices with QR codes. Check any ticket on the city's official parking clerk page before paying (BPD community alert).
Houston: the city's parking department said in 2022 that it does not use QR codes on its on-street pay stations (Houston Parking notice). Check with the city for current payment options.
Elsewhere: rules and payment options vary by city. Check your city's parking department website, typed in yourself.

Good to know

This scam is often called "quishing": QR code plus phishing.
Most phone cameras show the web address before you open it. Make reading it a habit.
Keeping your phone's software up to date and using two-factor authentication on your accounts limits the damage if you do scan a bad code.

Dana parks downtown in Chicago and sees a QR code sticker on the pay box, slightly crooked. When she points her camera at it, the address that appears has nothing to do with the city. She doesn't open it, pays at the machine instead, and reports the sticker to the city with a photo.

A made-up story, for illustration.

Bobby

Sources, verification, confidence

Verified on November 5, 2026, for the United States. Confidence: high for how to spot fake codes and what to do, which the FTC describes; medium for city contacts and payment options, which can change. This guide describes common cases and is not legal advice.