Scan With a Plan | Protecting Yourself From QR Code Scams

Introduction | The Small Square That Deserves a Second Look

QR codes are now part of daily life. They appear on menus, parking meters, product packaging, delivery notices, event tickets, store signs, donation pages, and appliance manuals and are frequently used in valid security activities like setting up multi-factor authentication or linking devices. Most are legitimate and useful. They open a website, payment page, form, or app download in seconds.

A QR code is not dangerous by itself. It is simply a quick and convenient way to open a link. The risk comes from where that link takes you and what the page asks you to do next. QR code safety starts with treating every scan the way you would treat a link in an email or text: useful when it makes sense, risky when it feels unexpected, rushed, or out of place. A brief pause before scanning a QR code is part of cyber protection, the everyday habit of protecting your accounts, devices, and personal information before something goes wrong.

Why QR Codes Are Easy to Trust

QR codes remove effort. One scan takes you straight to the next step. The problem is the destination is hidden until your phone reads the code. Scammers use that gap, especially when people are busy, distracted, or standing in a place where the code seems official. A code on a sign, package, or payment kiosk can feel trustworthy simply because of where it appears.

In addition, many apps and devices now use QR codes to securely connect accounts, approve logins, or set up security features. Apps like WhatsApp, Signal, Telegram, Discord, and ChatGPT use QR codes to link a new phone, tablet, or computer to your existing account. In these cases, scanning the code is not just opening a webpage; it can actually authorize a device to access your account.

People are naturally inclined to trust these QR codes because they’ve become a normal, low-friction part of everyday life. Most users don’t think of the scan as a security decision; they see it as a quick setup step and often approve it without much scrutiny.

How QR Code Scams Work

Most QR code scams are phishing scams with a different delivery method. Instead of asking you to click a link, the scammer asks you to scan a code. The goal is usually to collect personal information, login credentials, or payment details, or to infect your device. In some cases, the page may prompt you to download an app or file you do not need.

These scams can happen in physical and digital spaces. A fake code may be placed over a legitimate one on a parking meter, poster, restaurant table, or payment kiosk. It may arrive in a text about a delivery problem, an email about an account issue, or a flyer left at your door.

One version is called QR code brushing. In this scam, someone sends or places a QR code in the hope that your curiosity will do the rest. It might appear inside an unsolicited package, on a postcard, or in a message connected to a delivery, utility, prize, or home service.

In device code authorization phishing, an attacker tricks you into approving their device as if it were your own. The attacker starts a login process for an app, say Microsoft 365, on their own computer, which generates QR code meant to connect a new device. Instead of using it themselves, they send the code to you, often disguised as something routine like a meeting invitation or login verification request. When you scan the code and approve the request, you’re authorizing the attacker’s device to access your account. Microsoft’s systems then issue the attacker a valid login token — essentially a digital “hall pass” that lets the attacker access your Microsoft 365 account without needing your password again.

QR Code Scams are Growing

QR code scams are a growing threat, as attackers increasingly exploit people’s trust to steal credentials, bypass security protections, and gain access to online accounts.The UK national fraud reporting center Action Fraud received 1,386 reports of people being targeted in 2024, compared with 100 in 2019. During Q4 2025, the Anti-Phishing Working Group reported its member Mimecast detected 655,673 unique malicious QR codes. Microsoft’s “Email threat landscape: Q1 2026 trends and insight” shows QR phishing attacks rising from 7.6 million in January 2026 to 18.7 million in March 2026, a 146 percent quarter-over-quarter increase. 

The FBI’s Internet Crime Complaint Center has issued at least three public service

announcements on malicious QR codes since 2022 and the FTC, the NYC Department of Transportation, Hawaiian Electric, Fort Lauderdale, and law enforcement bodies in multiple countries have all issued consumer advisories in recent years.

Signs a QR Code May Be a Scam

A suspicious QR code usually relies on familiar phishing scam tactics, including urgency, impersonation, or requests that do not match the situation.

• Be careful if a QR code appears in an unexpected package, message, flyer, or email. Look closely if it seems to be printed on a sticker and placed over another code. 
• Pause to examine the URL that is displayed before clicking and do not click if the web address looks misspelled, shortened, or unrelated to the organization. 
• Be especially cautious of QR codes that appear in device linking, multi-factor authentication enrollment, or sign-in contexts unless you started the action yourself. 
• Tread carefully if the page it opens asks for passwords, payment details, or personal information.

A simple rule helps: Only scan QR codes you were expecting and come directly from a trusted service or device you initiated yourself. If the result does not match the reason you scanned, STOP! A menu should not ask for your banking login. A delivery notice should not require sensitive information before showing basic details.

How to Practice QR Code Safety

You do not need to avoid QR codes altogether. The goal is to build a few safety habits that become automatic.

• Use your phone’s built-in camera rather than downloading a third-party QR scanner. 
• Look at the URL preview on your phone to make sure the web address matches the website you expect to visit. If the domain does not match, stop.
• Enable multi-factor authentication on anything that supports it, or passkeys which are now widely supported across major platforms.
• Keep your phone and apps updated. Browser and operating system protections work best on current versions.

When money, passwords, or personal information are involved, take the longer route. Type the official website into your browser, open the company’s app directly, or use a phone number you know is real. Keep your device updated, use strong passwords, and turn on multi-factor authentication for important accounts. 

For more help with these basics, the free GCA Cybersecurity Toolkit for Individuals offers easy to follow steps for strengthening passwords, securing devices, and reducing common cyber risks.

What to Do If You Think You Scanned a Malicious QR Code

First, do not panic. What you do next depends on what happened after the scan.

If you only opened a web page and did not enter information, close the tab. If you entered a username or password, change that password right away. Turn on multi-factor authentication or create a passkey if available.

If you entered payment details, contact your bank or credit card provider and monitor your accounts for unfamiliar charges. If you downloaded an app or file, delete it, review any permissions you granted, and update your phone’s operating system if it isn’t up to date. Save screenshots, messages, receipts, or web addresses connected to the incident. Those details can help if you need to report the scam. 

If personal information may have been exposed, consider checking your credit report, placing a fraud alert, or freezing your credit. Reporting the incident can also help protect others from the same tactic.

The Takeaway | The Best Protection Is a Pause Before Scanning

QR codes are designed to make life easier, and most of them do. The point is not to make every scan feel suspicious. It is to stop automatically trusting scannable things.

Scammers count on momentum. They want the quick tap, the rushed payment, the reflex to follow instructions because the code looks ordinary. Your best defense is the small pause between seeing a QR code and acting on it.

That pause is where cyber safety lives. It is where you notice the sticker that does not belong, the web address that feels off, or the request you weren’t expecting. Scan when the source makes sense. Stop when it does not. A few seconds of caution can protect your money, your accounts, and the confidence you need to move through the digital world safely.