📷 QR Code Scams (Quishing): That Little Square Can Steal Real Money

By Muhammad Imran · Reviewed for accuracy against FTC and SSA fraud-investigator guidance · Last updated October 2026.

That little black-and-white square is everywhere now. On restaurant tables, parking meters, church bulletins, and packages at your door. Point your phone at it, and a website opens. Simple.

Too simple, say the scammers. Because a QR code is a link you can't read, it's the perfect hiding place. In September 2026, both the FTC and Social Security's fraud investigators issued alerts about QR-code scams. And the FBI's 2025 crime report shows the money behind them: $389 million lost through crypto ATMs and QR codes in a single year, with victims over 60 losing the most.

This guide shows you the four QR scams going around right now, the 10-second check that beats all of them, and exactly what to do if you already scanned one. And hear this first: if you scanned a bad code, you did nothing wrong. The embarrassment you might feel is part of the trap. The scam is designed to work on careful people.

Scam #1: The parking meter sticker

FTC alert, September 3, 2026. People have reported scammers covering the real QR codes on parking meters with codes of their own. You scan what looks like the meter's code, and it takes you to a fake payment site. Built to steal your money, your personal information, or both.

The fix is beautifully low-tech: look at the code before you scan it. If it looks like a sticker pasted over the original. Edges curling, slightly crooked, sitting on top of another code. Don't scan it. Pay through the parking operator's official app or the meter itself instead. And tell the parking company; they'll want to know their meters were tampered with.

Scam #2: The bail-or-fine QR code

Social Security fraud-investigator alert, September 28, 2026. Titled "Think Before You Scan." A scammer calls, texts, or emails pretending to be law enforcement or a federal agent. You're told you owe a fine. Or that a family member, often an adult child, has been arrested and needs bail. Then they send you a barcode or QR code.

You're told to take it to a store, have the clerk scan it, pay, and read back the code once it's paid. The alert warns that scammers can even use voice-cloning tools to make the call sound like your family member. And it puts the point plainly: "the barcode itself is the scam."

You hand over cash at a register, and the code sends that money wherever the scammer set it up to go. Without you ever giving out a single piece of personal information. No real government agency will ever send you a QR code to pay a fine. Ever.

Scam #3: The Bitcoin ATM QR code

The FTC describes it step by step: a caller. Pretending to be your bank, a government agency, or tech support. Announces an urgent problem and tells you to withdraw your own money and feed it into a Bitcoin ATM "to keep it safe." Then they text you a QR code and tell you to scan it at the machine.

Here's what that code really does: it routes your cryptocurrency purchase straight into the scammer's digital wallet. No matter what story they told you about a "protective account." There is no protective account. The emergency was manufactured to frighten you into moving your real money to a criminal.

The FBI's 2025 numbers show how big this has become: 13,460 complaints about crypto ATMs and kiosks, $389 million in losses. Complaints up 23% and losses up 58% from 2024. And victims 60 and older filed 6,188 of those complaints and lost $257 million. More than any other age group.

The FBI names one more warning sign: the scammer stays on the phone and coaches you, button by button. And tells you what to say if a bank employee asks questions. If anyone ever coaches you through a cash withdrawal while a stranger listens in by phone, hang up. That's the scam talking.

Scam #4: The QR code in your email or text

The FTC's advice is simple: don't scan a QR code in an email or text you weren't expecting, especially one that urges you to act immediately. The usual pretexts: a package that couldn't be delivered, a problem with your account, "suspicious activity" that requires a password change. If the message might be real, contact the company using a phone number or website you know is genuine. Never the one in the message.

Scammers love QR codes in messages because they're harder for email filters to inspect than a normal link. And because scanning moves you from your computer to your phone, where you're less guarded.

The scale: in 2025, about 12% of all phishing attacks contained a QR code, and 68% of those targeted phones. QR-based phishing emails surged from roughly 47,000 in August to over 249,000 in November 2025. In Britain, police recorded 784 quishing reports in a single year, with nearly £3.5 million lost. And the FBI counted phishing. Including scam texts. As its single biggest complaint category in 2025: 191,561 reports.

Why this scam works

A QR code asks for something your brain isn't built to do: judge a link you can't see. With an email link, you can hover and inspect the address; with a QR code, there's nothing to inspect. Just a pattern of squares. That gap between trust and evidence is the whole trick.

Then scammers add the two oldest levers in the book: urgency ("pay in 10 minutes or your car is towed") and authority (a badge, a logo, a uniform-sounding voice). For seniors, there's a third lever: these codes only became common in the last few years, so there's no lifetime of instincts to fall back on. And your phone helpfully opens the link the instant you point the camera, before you've had a second to think. The fix isn't better eyesight. It's a pause.

5 signs it's fake

• It's a sticker on top of the real code. Edges curling, slightly crooked, or covering the original.
• It arrived in an email or text you weren't expecting, especially one demanding immediate action.
• The page it opens asks for a password, card number, or payment before you've verified the address.
• The web address your camera previews looks wrong. Misspellings, extra words, or a domain you've never heard of.
• Someone is pressuring you to scan it right now. A caller on the phone, a "technician" at your door, a countdown on the page. Pressure is the tell.

The 10-second check before you scan

1. Pause. Ask: who put this code here, and did I expect it?
2. Look at the physical code. Sticker over the original? Walk away and use the official route.
3. Point your camera and read the address it shows. Don't tap yet. If you can't read it or it looks wrong, stop.
4. Never enter a password or payment details on a page you reached by QR code unless you verified the address independently. Type the site's address yourself instead.
5. When in doubt, use the known route: the company's official app, the number on your card, the website you typed yourself.

The FTC adds two standing habits that help everywhere, not just with QR codes: keep your phone's software up to date, and protect your accounts with strong passwords plus multi-factor authentication (that second code texted to your phone when you log in).

What the real agencies actually do

• The FTC will never text, email, or call you with a QR code to pay anything.
• The Social Security Administration will never send you a barcode or QR code for a fine or bail. The SSA's own fraud alert says "the barcode itself is the scam."
• Parking operators and toll agencies have official apps and websites. A sticker on a pole is never the only way to pay.
• Real companies don't rush you. "Scan in the next 10 minutes or else" is never how a legitimate payment works.

I already scanned one. What now?

1. Stop. Close the page and don't enter anything else.
2. If you entered card or bank details, call your bank or card company right away. Use the number on your card, not one from the message.
3. If you entered a password, change it on the real website. And anywhere else you used the same password.
4. If you installed an app from the page, uninstall it and run your phone's security check.
5. Report it: the FTC at ReportFraud.ftc.gov, the FBI at ic3.gov. And if it impersonated Social Security, the SSA fraud hotline at 1-800-269-0271. Also tell the business whose code was faked, like the parking operator.

If you fed cash into a Bitcoin ATM: call your bank the same day and ask whether anything can be recalled. Crypto transfers are usually irreversible. Which is exactly why scammers insist on them. But reporting immediately is still the right move, and your report helps investigators connect cases.

For the full step-by-step recovery playbook. Freezing credit, protecting accounts, and reporting everywhere that counts. See our guide: Clicked a Scam Link? Do This Now.

Related guides

• Clicked a Scam Link? Do This Now. The full recovery playbook.
• Investment & Crypto "Pig Butchering" Scams. How crypto scams drain life savings.
• The "Grandchild in Trouble" Phone Scam. The bail-money script behind Scam #2.
• Package & Toll Fee Text Scams. The "unexpected message" playbook behind Scam #4.

Related: PHP2Shell Explained: The Website Bug and the Scam Texts →

Sources: FTC consumer alert, September 3, 2026 (QR codes on parking meters); Social Security Administration OIG alert, September 28, 2026 ("Think Before You Scan. Beware of QR Code Phishing"); FBI IC3 2025 Internet Crime Report (crypto ATM/kiosk fraud: 13,460 complaints, $389M in losses; phishing: 191,561 complaints); Keepnet quishing statistics 2026; UK Action Fraud figures via Axis Intelligence (Apr 2024 – Apr 2025). Last updated October 2026.