QR codes have become part of everyday life. You can use them to view a restaurant menu, pay for parking, board a flight, download an app, or complete a purchase in just a few seconds.
Their convenience is one of the reasons they’ve become so popular. Unfortunately, it’s also one of the reasons scammers have started using them to steal personal and financial information.
Known as QR code scams, or sometimes “quishing,” these scams rely on people scanning first and asking questions later. By hiding malicious links inside what appears to be a normal QR code, scammers can trick victims into visiting fake websites, revealing sensitive information, or even installing malware on their phones.
At YouMail, we’re committed to helping people stay informed about the latest scams and threats. Understanding how QR code scams work is one of the easiest ways to avoid becoming a victim.
Download YouMail and instantly stop spam calls, texts, and voicemail.
How QR code scams work
Unlike a traditional web link, a QR code doesn’t tell you where it’s taking you until after you’ve scanned it. That gives scammers an opportunity to disguise malicious websites as something completely legitimate.
One common example involves public parking meters. Reports have surfaced of scammers placing fake QR code stickers directly over the legitimate ones. Drivers believe they’re paying for parking, but instead they’re redirected to a fraudulent payment page designed to collect their credit card information.
Scammers also send QR codes through emails and text messages, often pretending to represent a trusted company or organization. Their goal is always the same: create a sense of urgency so you scan the code without stopping to think.
The stories scammers use to get you to scan
Most QR code scams begin with a convincing story. The message is designed to make you believe something needs your immediate attention.
Some of the most common examples include:
- “We couldn’t deliver your package.” The message asks you to scan a QR code to reschedule delivery or pay a small fee. In reality, the QR code leads to a fraudulent website that attempts to steal your payment information or personal details.
- “There’s a problem with your account.” Scammers may claim your bank, streaming service, or another online account needs to be verified. The QR code directs you to a fake login page that captures your username and password.
- “We detected suspicious activity.” Messages like these are designed to create panic. They often encourage you to scan a QR code to reset your password or secure your account, but the website is controlled by scammers looking to collect your credentials.
These scams succeed because they create urgency. When people believe there’s a problem that needs immediate attention, they’re less likely to question where the QR code is actually taking them.
What can happen after you scan?
Not every QR code is dangerous, but a malicious one can cause problems very quickly.
In some cases, the QR code takes you to a spoofed website that closely resembles a legitimate business. If you enter your username, password, payment information, or other personal details, that information goes directly to the scammer.
In other situations, the QR code may prompt you to download software or install an application that contains malware. Once installed, that malware could collect sensitive information from your device without your knowledge.
The scam itself only takes a few seconds, but recovering from identity theft or financial fraud can take much longer.
How to protect yourself
Fortunately, avoiding QR code scams doesn’t require any technical expertise. A few simple habits can go a long way toward protecting your information.
- Take a moment to inspect the website before interacting with it. After scanning a QR code, look closely at the web address before entering any information. Even if the site looks familiar, check for misspellings, unusual domain names, or small changes that could indicate you’re on a fraudulent website.
- Be skeptical of QR codes sent through emails or text messages. If you weren’t expecting the message—especially one urging you to act immediately—don’t scan the code. Instead, contact the company using a phone number or website you already know is legitimate.
- Keep your phone and online accounts secure. Installing software updates, using strong and unique passwords, and enabling multi-factor authentication all make it more difficult for scammers to access your accounts, even if they obtain some of your information.
How YouMail can help
Many QR code scams don’t begin with the QR code itself. They start with a spam text message or scam phone call that encourages you to scan one.
That’s where YouMail can help.
YouMail helps identify and block many scam calls before they ever reach you, making it easier to avoid the conversations that often lead to phishing attempts and QR code scams. If you receive a suspicious text or message containing a QR code, you can also use YouMail’s screenshot reporting feature to help identify emerging scams and warn other users.
Learn more about YouMail’s screenshot reporting feature here:
QR codes have made everyday tasks faster and more convenient, but like many useful technologies, they’ve also created new opportunities for scammers. The next time you’re asked to scan a QR code, take a few extra seconds to think about where it came from and where it’s taking you. That small pause could prevent a much bigger problem.
For more tips on protecting yourself from phone scams, phishing attempts, and identity theft, visit the YouMail Blog.
Source and attribution
This article was adapted from the Federal Trade Commission’s consumer alert, “Scammers hide harmful links in QR codes to steal your information,” by Alvaro Puig (December 6, 2023), and has been expanded with additional guidance and educational information.
Original source: https://consumer.ftc.gov/consumer-alerts/2023/12/scammers-hide-harmful-links-qr-codes-steal-your-information
