QR code scams

QR codes are handy, but you can't see where one goes until you scan it. Criminals stick fake codes over real ones and send them in emails and letters to get past security filters.

Where fake QR codes turn up

• Car parks and parking meters: stickers leading to fake payment sites that take your card details and sometimes sign you up for subscriptions.
• Emails and letters: "scan to verify your account", "scan to pay your fine", or "scan to set up two-step verification".
• Restaurants, posters and EV chargers: codes placed over the genuine ones.
• Parcels you didn't order with a QR code to "find out who sent it".

Scan safely

• Check for stickers. If a code looks stuck on top of another, is peeling or looks out of place, don't use it.
• Look at the web address your phone shows before opening it. Does it match the company you expect?
• Prefer the official app for parking and payments. Download the app named on the official signs from your app store, rather than scanning.
• Never scan a code in an unexpected email to log in to your bank or "verify" an account.
• Use your phone's built-in camera to scan. You don't need a separate QR scanner app, and some of those are risky.

Last reviewed: October 2026