How to Spot a QR Code Scam: Check the Sticker, Then the Link

Patrol Blog · 28 October 2026 · Reading time: about 5 minutes

Learning how to spot a QR code scam starts with one fact: a QR code is a link you cannot read. A link in an email shows its address. A square of black and white boxes shows nothing — you scan first and find out where you landed after. Tethers count on that order. The checks here run the other way: sticker first, link second, money last.

A link you can't read

The scam has a name in the security trade: a QR code phishing scam, or quishing scam — phishing carried by a code instead of a clickable link. The code is harmless. The page behind it does the work.

The FBI said it plainly in a public service announcement in January 2022: criminals tamper with both digital and physical QR codes, replacing honest codes with their own, and the scan sends you to a site built to take login and financial information. The Federal Trade Commission followed on 6 December 2023 — scammers hide harmful links in QR codes to steal personal information, and the lies they tell to get the scan are built to create urgency.

Two settings carry most of the risk: a code stuck on a public surface — a meter, a sign, a table tent — and a code that arrives uninvited, in a text, an email, or a box you never ordered.

Sixty-four stickers in Manhattan

Parking is where the physical version got caught at scale. On 30 September 2026, Manhattan prosecutors announced an indictment: investigators found 64 fraudulent QR code stickers on meters across Manhattan, each pointing to a page dressed up as the city's ParkNYC platform. The page asked for card details, a phone number, a billing address, and a plate number.

The scheme cracked in June 2025, on East 10th Street. A driver scanned a fake QR code parking meter sticker, watched the page stall again and again, looked closer — and found the sticker sitting on top of the meter's real payment information. He called his bank before any money moved. The city's Department of Transportation then inspected meters across Manhattan and pulled the fakes down. The charges are allegations and the case is still open.

New York's transportation department keeps its rule short: the city does not ask drivers to scan a QR code to pay for parking — metered parking is paid through the official ParkNYC app or by card at the meter. Ann Arbor, Michigan, ran into the same trick in October 2026: "Scan to Park!" stickers on downtown meters, pulled by city crews after police warned drivers off them. A sticker is cheap. That is the whole business model.

The code that arrives uninvited

The digital version skips the sticker and goes straight to your messages. The FTC's December 2023 alert lists the scripts: a package that could not be delivered, a problem with your account, suspicious activity needing a password change right now. Each story hands you a code and a reason to scan before you think.

Packages got their own twist. On 31 July 2025 the FBI warned about unsolicited packages carrying a QR code and no sender information — scan it, the note suggests, to learn who sent the gift or start a return. The code leads to a page asking for personal and financial information, or pushes software that takes data off the phone. The FTC covered the same ground in August 2026: the box holds something cheap and random — baby wipes, toothpaste, seeds — and the sender's real product is the scan. Federal law treats unordered merchandise as yours to keep. Nobody honest needs a scan to return a gift you never asked for.

How to spot a QR code scam in ten seconds

Ten seconds is enough, if you spend them in the right order:

• Touch the sticker before you scan it. A code that is crooked, bubbled, peeling, or layered over another code was added later. On a meter or sign, that ends the inspection.
• Read the preview, not the page. Most phone cameras show the address first. Misspellings, swapped letters, a short link, or a domain with no tie to the city or company in front of you — close it.
• Refuse the rush. A code paired with a deadline or a fee warning is selling speed. Real parking and real deliveries survive a ten-minute check.
• Watch what the page asks for. Parking needs a plate and a card — not your billing address, birth date, or account password. A page asking past its job is harvesting, the same grab you see in a fake giveaway scam.
• Never take an app from a code. If a scan wants to install something, stop. Get the app from your phone's app store, or skip it.
• Pay where you chose to go. Open the official app yourself, or type the address you know. It is the family code word rule pointed at a screen: trust only the channel you picked.

Already scanned one?

Work fast and in order. Close the page and do not go back to argue with it — the FTC warns that contacting whoever runs a fake site just opens a second pitch. If you typed a password, change it now, everywhere that password still works. If you typed card details, call the bank on the number on the back of the card and walk the recent charges together. Then report it: the FTC at ReportFraud.ftc.gov, the FBI's Internet Crime Complaint Center at ic3.gov. Attach the meter location or the message — it gives the next crew something to pull down.

The square is not going away — menus, tickets, and meters run on it, and most codes you meet are honest. The rule is narrower than fear: never let a sticker or a surprise message decide where your phone goes. The officer's beat is laid out on the About page, and if a code on your block looks planted — crooked sticker, wrong address, a page asking too much — report a tether with the location and a photo of the code.