The QR code scam: what the FTC, FBI and SSA say

The trick, in one paragraph

The FTC’s consumer alert of 3 September 2026 states it in two sentences. People have reported scammers covering up real QR codes on parking meters with a QR code of their own, and if you scan the fake one, it could take you to a fake site designed to steal your money, your personal information, or both.

The Social Security Administration, in a blog post of 22 February 2024, gives the same move on parking meters, menus and magazines, and adds codes sent by email or text that pretend to come from delivery companies, a request to confirm your information because of suspicious activity, and harmful codes placed in social media ads. Commerce Bank, on a page of 24 November 2025, describes the sticker version: scammers can take a sign that shows a legitimate organization’s QR code and cover it with a sticker bearing a different code that sends the victim to the phishing site. The FBI’s alert of January 2022 puts the same idea in general terms: criminals tamper with both digital and physical codes to replace legitimate ones, and a victim scans what they think is a legitimate code.

Why does it work? AARP’s article, updated on 7 March 2025 from a text first published in 2022, says the naked eye cannot detect which codes are genuine and which are the work of scammers, and that codes can be created quickly and are cheap to distribute. It quotes Jennifer Pitt, a senior analyst at the research firm Javelin: “It’s ridiculously easy.” The pages we read come from United States agencies, a bank, a news station and an association, so the advice and the places to report are American ones.

The places a fake code turns up

The pages we read do not list the same places, and putting them side by side shows a pattern. Both FTC alerts name the parking meter. The 2023 alert adds that a scammer might send a code by text message or email with a made-up reason to scan it, and it lists three: the package could not be delivered and you must reschedule, there is a problem with your account and you must confirm your information, or there was suspicious activity and you must change your password. The FTC calls these lies told to create a sense of urgency, so that you scan the code and open the address without thinking.

AARP lists five forms. The first is a sticker over a legitimate code, with the parking meter as the example from Steve Weisman, a law professor at Bentley University. The second is fake codes on flyers, in restaurants and in other public places. The third is a code in an email or text, which AARP calls “squishing”. The fourth is fake tickets for sports and concerts, because codes shown on a phone serve as admission. The fifth is an offer by mail: a letter through the Postal Service with a code that offers loan forgiveness, demands payment of a bill or promises big discounts.

Commerce Bank adds the unsolicited package. It says that, according to the FTC, one of the most popular ways is an unsolicited package carrying a code that invites you to “scan to see who sent this”. Sandy Ozier, a senior vice president at the bank who works in fraud prevention, calls an unexpected package a red flag. Our page on scam text messages covers the text version, and our page on the phishing email covers the email one.

The pages differ on which door is the common one, and the pages we read do not give a count. In AARP’s article, a code in an email or text is called the most common QR scam, according to Weisman. NBC New York, reporting on the FTC’s warning in December 2023, quotes the security research analyst Jeremy Fuchs saying that email seems to be the dominant vector and is “by far the easiest”. The FTC’s 2026 alert, the Social Security post and Commerce Bank open with the sticker on a sign. That is a difference of emphasis, not a contradiction of fact.

What a fake code is trying to get

The pages describe three outcomes. The first is a cloned site. The FTC’s 2023 alert says a scammer’s code could take you to a spoofed site that looks real but is not, and if you log in, the scammers could steal any information you enter. Commerce Bank says the phishing site asks for credentials such as banking information, card numbers or passwords, and the FBI says it prompts you to enter login and financial information, which gives the criminal the ability to potentially steal funds through your accounts.

The second is malware. The FTC says the code could install malware that steals your information before you realize it. The FBI says a malicious code may contain embedded malware that lets a criminal reach your mobile device and steal your location as well as personal and financial information. The Social Security post says a fake code can send you to a fake site or lead you to download malware. The FBI also writes that QR codes are not malicious in nature, and asks for caution when entering financial information or paying through a site reached by a code.

The third is a payment that goes to the wrong person. The FBI describes a business that gives customers a code leading to a payment page; a criminal replaces the intended code with a tampered one and the sender’s payment is redirected for the criminal’s use. It adds that law enforcement cannot guarantee the recovery of lost funds after a transfer. The Social Security post gives a version with a government name on it: a scammer posing as a Social Security employee claims an outstanding debt or a problem with your account and sends a code by text or email to request payment. The agency says it will never request any form of payment using a QR code.

NBC New York repeats the FTC’s warning of the consequences: thieves can empty bank accounts, make fraudulent credit card charges, open new accounts in your name and even file fraudulent tax returns. The pages we read do not say how many people have lost money to a fake code, or how much on average.

Checking where a code goes

The address. The FTC’s 2026 alert tells you to inspect the link and says many QR readers preview the link they will send you to; check that there are no spelling mistakes or switched letters before you click. USPS Link, the Postal Service’s employee news site, wrote on 12 August 2026, for employees using USPS-issued devices, to preview the website address before opening any links, “if possible”. The FBI puts the check later: once you scan a code, check the URL to make sure it is the intended site and looks authentic, because a malicious domain name may be similar to the intended one but with typos or a misplaced letter. The FTC’s 2023 alert adds that even a URL that looks familiar needs a check that it is not spoofed. The pages we read do not say how to bring up the preview on a particular phone; our page on scanning QR codes covers the scanning itself.

The sticker. For a code on a sign or a menu, the FBI says to make sure it has not been tampered with, for example by a sticker placed on top of the original. USPS Link says to look for stickers or labels over legitimate codes. Weisman, in AARP’s article, says to check even when the code is in a secure place such as a business or bank. The Social Security post says to look for signs of tampering, unusual colors or misspellings, and to avoid scanning if something seems suspicious; Commerce Bank, passing on the agency’s tips, says to check whether a code on a physical sign was put there as a sticker, and Ozier adds blurry logos and strange formatting. The pages we read do not describe what a well-made overlay looks like or give a physical test beyond looking.

The app. The FBI says not to download an app from a code and to use your phone’s app store instead. It also says not to download a QR code scanner app, which increases the risk of malware, and notes that most phones have a built-in scanner in the camera app. The pages from the FTC, the Social Security Administration, AARP, USPS Link and Commerce Bank do not mention scanner apps.

The detour. Several pages suggest not using the code at all. AARP says to use a search engine, not a QR code: Pitt’s own habit, when a restaurant wants the menu read through a code, is to take out the phone and go to the restaurant’s website directly. Commerce Bank, relaying the Social Security tips, says it is always better to type a URL directly into your browser and not to scan a code from an unsolicited package, because you should never need to scan a code to find out who sent you a package. The FBI says to type a known and trusted address to make a payment. For a code that arrives in a message, the FTC says not to scan one in an email or text you were not expecting, especially if it urges you to act immediately, and to contact the company with a phone number or website you know is real. The FBI and AARP say the same about a code that seems to come from someone you know: reach them through a known number or address. The FBI adds one case: if an email says a payment failed and the only way to pay is a QR code, call the company, using a phone number found on a trusted site and not the one in the email.

The source. Kathy Stokes, director of fraud prevention at the AARP Fraud Watch Network, says a code in a magazine from a publisher you know, or on the website of a company you do business with, is generally safe, while codes found in the real world, such as restaurants and flyers, are easily manipulated. For the phone itself, the FTC says to update the operating system and apps and to use strong passwords and multi-factor authentication; AARP adds that you could consider antivirus software.

If you already scanned it

The FTC’s 2026 alert gives four steps for someone who thinks they scanned a bad code. Do not interact with the scammer, because if you reach out to someone through the site you think is fake, they may try to get money or sensitive information out of you. If you entered a username or password, change it immediately, and change it wherever else you use the same password. Check your credit card and bank statements for transactions you did not make. Then report it to the FTC at ReportFraud.ftc.gov.

Commerce Bank’s order starts differently: stay calm, then call your bank. It also says to change the passwords of any account that may have been compromised and to turn on two-factor authentication where you can. It adds that the FTC suggests signing up for a free credit report, and that if you believe someone stole your identity you can file a report at IdentityTheft.gov. NBC New York points to the same address for victims. Ozier, in the bank’s page, says a person who has fallen victim is not alone and is not to blame.

On where to report, the pages do not agree on one place. The FBI says to report a loss from a tampered code to the local FBI field office and to its Internet Crime Complaint Center at ic3.gov. AARP says to report to local law enforcement, and that you can also report to the IC3, the FTC or your state’s attorney general, noting that not every complaint leads to enforcement action but that the information can help officials spot trends. The Social Security post sends reports of Social Security impostors to the Office of the Inspector General. USPS Link tells its readers to report suspicious codes or websites. Our page on reporting scams sets out the routes in one place.

On money, the FBI alert says law enforcement cannot guarantee the recovery of lost funds after a transfer. Whether paying by card makes a refund easier is not something the pages we read say; our page on scam refunds covers what the FTC and the CFPB say about US payments.

Where the pages agree and where they differ

The core advice is the same from 2022 to 2026: be suspicious of a code you did not expect, look at the address, look for a sticker, and keep the phone and accounts protected. The pages differ in a few places, and the table above and the figures show where.

• The name. NBC New York (relaying the FTC), Commerce Bank and USPS Link call it “quishing”; AARP calls the email and text version “squishing”.
• The moment of the check. The FTC and USPS Link say to preview the address before opening it; the FBI says to check it after the scan.
• The scanner app. The FBI says not to download one; the FTC, Social Security, AARP, USPS Link and Commerce Bank pages do not mention scanner apps.
• The common door. AARP (through Weisman) and NBC New York (through Fuchs) name email or text as the most common or dominant route; the FTC’s 2026 alert, the Social Security post and Commerce Bank put the sticker first.
• The place to report. The FTC names ReportFraud.ftc.gov, the FBI names ic3.gov and its field offices, NBC New York and Commerce Bank name IdentityTheft.gov for identity theft, AARP lists four places, and the Social Security post names its Office of the Inspector General for impostors.

The pages we read do not say how many people have lost money, how to recognize a well-made sticker, or what the preview shows on a given phone model. They also do not say that the preview alone is enough: the FTC asks for a look for switched letters, not for trust in a link that appears familiar.