QR Code Scams: How Scammers Hide Fake Links in Plain Sight
Learn how QR code scams work, where they appear, and how to check preview links before tapping.
Lesson content
Lesson Summary
QR codes are useful shortcuts. You can scan them with your phone to open a website, menu, payment page, form, or app.
But scammers can also use QR codes to hide fake links. This type of scam is sometimes called quishing. Quishing means "QR phishing." Phishing is when a scammer pretends to be a trusted person or company to steal information.
A QR code scam often works because the real website address is hidden inside the square code. You cannot see where it goes until your phone shows a preview link.
This lesson explains how QR code scams work, where they appear, and what to do before you tap.
Why This Matters
QR codes are now part of daily life. You may see them on restaurant tables, parking meters, event flyers, bills, delivery notices, emails, and signs.
Most QR codes are safe. The problem is that a scam QR code can look exactly like a real one.
Learning how these scams work helps you protect passwords and bank information, avoid fake payment pages, stay safer when using your phone in public, feel more confident when scanning QR codes, and help friends, family members, and caregivers spot warning signs.
The goal is not to fear technology. The goal is to slow down and stay in control.
What You Need to Know
1. QR Codes Hide the Destination
A regular website link may show you where it goes. For example, you might see examplebank.com. A QR code hides that address inside a square image. You cannot know the destination just by looking at the code. That is why your phone's preview link matters. The preview is the small website address that appears before you tap. If the preview looks strange, do not continue.
2. Scammers Use Trust and Urgency
Many scams work by making you feel worried, rushed, or curious. A scam QR code may come with a message like "Your payment failed," "Scan to avoid a late fee," "Your package is waiting," "Your account will be locked," "Scan to view your document," or "Scan to claim your refund." These messages are designed to make you act quickly. A safe habit is to pause before scanning or tapping. Scammers want speed. Safety needs a moment.
3. QR Code Scams Can Appear Online and Offline
QR code scams are tricky because they can show up in both digital and physical places.
In Emails
A scam email may include a QR code instead of a clickable link. It may look like a bill, document, bank notice, benefits message, password alert, or delivery update. Be careful when an email asks you to scan a QR code with your phone. This can move you away from the safer tools on your computer or email system.
On Public Signs
Scammers may place fake QR code stickers over real ones. This can happen on parking meters, restaurant signs, posters, community boards, or event flyers. Before scanning a public QR code, look closely. Check if it appears to be a sticker placed on top of another code.
In Mail or Package Notices
A fake delivery notice may say you missed a package. It may ask you to scan a QR code to reschedule delivery or pay a small fee. This can lead to a fake website that asks for your name, address, card number, or password.
How a QR Code Scam Usually Works
Here is a common pattern:
- You see a QR code in an email, on a sign, or on a notice.
- The message tells you to scan the code.
- Your phone shows a preview link.
- If you tap, the website may look official.
- The website asks for personal information, payment details, or a password.
- The scammer collects what you enter.
The real danger
The danger is usually not the scan by itself. The bigger danger is what happens after you tap the link and type in private information.
What to Do If You Already Scanned a Suspicious QR Code
Stay calm. A mistake can often be fixed.
If You Only Scanned the Code
If you scanned the code but did not tap the link, you are likely okay. Close the camera app.
If You Tapped the Link
If you tapped the link but did not enter information, close the web page. Do not download anything. Do not call phone numbers shown on the suspicious page.
If You Entered a Password
Change that password right away. If you use the same password anywhere else, change it there too. Ask a trusted person for help if needed.
If You Entered Bank or Card Information
Contact your bank or card company using the number on the back of your card. Tell them what happened. Do not use a phone number from the suspicious website.
If You Downloaded an App or File
Do not open it. Ask a trusted person, family member, or professional for help checking your phone.
Common Mistakes or Confusions
"The QR Code Was on a Real Sign, So It Must Be Safe"
Not always. A scammer can place a fake sticker over a real QR code. The sign may be real, but the sticker may not be.
"The Website Looked Professional"
Fake websites can look very real. Scammers can copy logos, colors, buttons, and official-sounding words. Do not trust a page only because it looks polished.
"It Asked for a Small Fee, So It Seemed Harmless"
Small fees can still be dangerous. A fake $1 or $2 fee may be used to collect your card number.
"I Should Have Known Better"
Please do not blame yourself. Scams are designed to trick people. The best response is to pause, get help, and take action quickly.
Safety Tip
Use this rule: Pause, verify, and ask for help.
Pause before tapping. Verify the website address. Ask for help if the message feels urgent, strange, or confusing.
A good extra habit is to avoid scanning QR codes from emails. Instead, go directly to the company's official website or app.
A QR code can hide the real website address. Always read the preview link before you tap.
Step-by-step actions
- Open your phone camera.
- Point it at the QR code.
- Wait for the preview link to appear.
- Do not tap right away.
- Read the website address carefully.
- Look for spelling mistakes or strange wording.
- Ask yourself: "Was I expecting this?"
- Ask yourself: "Is this asking for private information?"
- If the link looks wrong, close the camera app.
- Use another trusted way to reach the company, such as its official app, official website, or phone number from a bill or card.
- You do not have to use the QR code. You can always choose a safer path.
Practice Activity
- Find a QR code on a household item, such as a cereal box, magazine, or product package.
- Open your phone camera.
- Point the camera at the QR code.
- Wait for the preview link.
- Read the website address.
- Close the camera app without tapping.
- This helps you learn where the preview link appears on your phone.
- Do not practice with QR codes from emails, text messages, or suspicious notices.
Related lessons
Keep learning with these related topics.
Stay Safe When Scanning: A Simple Guide to QR Codes
Learn how to scan QR codes safely, spot warning signs, and avoid QR code scams that can lead to fake websites.
How to Recognize a Phishing Email
Learn how to spot fake emails that try to steal your passwords, money, or personal information.
What Is a Scam?
Learn what a scam is, why scammers target people, and the simple habits that help you stay safe every day.
What to Do If You Think You Were Scammed
Clear steps to take right away if you shared information, sent money, or clicked something suspicious.
Getting Comfortable With Your Smartphone
A calm, beginner-friendly lesson for learning the basic parts of your phone one step at a time.