QR Code Scams Are Exploding: How to Spot a Malicious Code

A QR code is a blind trust exercise. Unlike a web link, you can't preview where it leads just by looking at it, you have to scan it first and hope it's legitimate. Scammers have noticed, and QR code scams have grown fast, especially in places where people scan on autopilot: parking meters, restaurant tables, and payment terminals.

A common version is a sticker placed directly over a legitimate code, often at a parking meter, redirecting your "pay for parking" scan to a fake payment page that captures your card details. The same trick shows up on restaurant menus, event posters, and even mailed letters pretending to be from a delivery company or government agency.

A few habits make QR codes much safer. Check for tampering, a sticker slightly misaligned or layered over another code is a red flag. Read the URL preview most phones show before fully opening the link, and make sure it matches the business or service you expect. Never enter passwords, seed phrases, or payment information on a page you reached by scanning a code in an untrusted public location. When in doubt, navigate to the business's site or app directly instead of scanning.

QR codes aren't inherently dangerous, but the blind trust people place in them is exactly what scammers are counting on. A few extra seconds of checking costs you nothing; skipping that check can cost a lot more.