QR Code Scams: How Quishing Works and How to Avoid It

A QR code hides the web address, so you cannot judge the link before you scan.

By Siddharth ShankarUpdated October 23, 2026

A QR code is just a picture that contains a web address. You cannot read the address by looking at it, which is why scammers like them. This guide follows two FTC consumer alerts.

How QR code scams work

In an alert first published in December 2023 and last updated in February 2024, the FTC describes two main tricks.

• Fake codes on real objects. Scammers cover a legitimate QR code, such as one on a parking meter, with their own.
• Codes sent to you. They send a QR code by text or email with a false reason to scan, such as a failed package delivery, a problem with your account or suspicious activity that needs a password change.

The messages create urgency so you scan without thinking. A scanned code can open a fake site that imitates a real one and captures anything you log in with, or it can install malware that steals your information.

The 2026 traffic-violation text

On April 14, 2026 the FTC published an alert about a text that contains a QR code and says you must scan it to pay a traffic violation and avoid court. The FTC says the message may include a state seal, a fake case number and a fake hearing date and time. It offers two options, attend the hearing or pay the fine now, and lists threats such as default judgments, fines and enforcement actions to make you act quickly.

The FTC says scanning the code can lead to theft of personal information, such as your Social Security or credit card number, and can download malware onto your phone. It reported a spike in complaints about this scam in the month before the alert. It gave no figures for reports or losses.

Warning signs

• A message you did not expect that demands fast action.
• A threat of a fine, court or account closure.
• A QR code instead of a normal link or a phone number you can check.
• A sticker placed over a code in a public place.
• A payment request that asks for card details after you scan.

What to do before you scan

1. Check the address. The FTC advises checking the URL for misspellings or swapped letters that suggest a fake.
2. Do not scan codes in unexpected emails or texts, especially ones that demand immediate action.
3. Check with the source. If the message might be real, contact the company or court using a phone number or website you already know is genuine.
4. Look at the physical code. If a sticker looks stuck on top of another, do not use it.
5. Keep your phone updated and protect online accounts with strong passwords and multi-factor authentication, as the FTC advises.

If you already scanned or paid

The FTC’s QR alert does not give a full checklist for after you scan, so these steps are general good practice rather than quotations. Do not enter any more details. If you typed a password, change it on the real site and on any account where you reused it. If you gave card details, contact your card issuer. If you paid or shared information, the FTC’s April alert points you to its guidance on what to do if you were scammed. Report the scam at ReportFraud.ftc.gov. You can read about reuse risks in credential stuffing explained.

Why these scams use texts

Texts feel personal and are read quickly. Scammers often get your number from earlier leaks. See how scammers get your phone number and email and phishing and smishing statistics.

A related scam

Another scam that can involve a QR code is the unordered package. Read what a brushing scam means.