QR code scams use a familiar square code to send people to harmful links. US and UK sources describe two ways this happens: scammers hide harmful links in codes or tamper with codes so that they lead to sites that steal personal, login and financial information. On how to check links, the sources reviewed here say only this: many QR readers show a preview of the link they will open.
What QR code scams are, according to official sources
The FTC consumer alert on QR code scams states that scammers hide harmful links in QR codes to steal personal information.
The FBI public service announcement on ic3.gov describes the same problem from a law enforcement point of view. It says cybercriminals are tampering with QR codes to send victims to malicious sites that steal login and financial information. It also says cybercriminals tamper with both digital and physical QR codes, replacing legitimate codes with malicious ones.
The same FBI announcement places this in context. According to that source, businesses used QR codes more often during the COVID-19 pandemic to provide contactless access. The NCSC blog post on the real risk of QR codes adds that QR codes have existed since the 90s and became prominent in the UK during COVID lockdowns.
The risk they describe comes from codes that scammers have hidden harmful links in or replaced.
Where QR code scams show up: parking meters, open spaces and email
Several of the sources describe specific places where tampered QR codes have appeared.
- Parking meters. The FTC consumer alert on QR code scams says there are reports of scammers covering QR codes on parking meters with their own QR codes. A separate FTC consumer alert on QR codes at parking spots says people have reported scammers covering legitimate QR codes on parking meters with their own QR codes.
- Open spaces. The NCSC blog post says most QR code-related fraud tends to happen in open spaces such as stations and car parks, and that it often involves social engineering.
- Email. The same NCSC post says the NCSC is seeing an increase in "quishing" attacks, where QR codes are sent in emails.
- Digital and physical codes. The FBI announcement says cybercriminals tamper with both digital and physical QR codes.
The FTC wording is about reports, and the NCSC wording uses "tends to" and "often". These sources do not give counts or a full map of where QR code scams occur.
Quishing: QR codes sent in emails
The term "quishing" appears in the NCSC blog post on QR code risk, which describes quishing attacks as attacks where QR codes are sent in emails. The NCSC says it is seeing an increase in these attacks.
The same post states that not every security tool built to detect phishing emails scans images. That is a statement about some email security tools. It does not say which tools scan images, how many do, or how a given inbox is protected.
Readers who want background on other forms of impersonation and phishing on this site can see our explainer on deepfake and voice-clone fraud and what officials say to check, or our explainer on passkeys, passwords, MFA and phishing resistance.
How to check links from a QR code: what the sources state
For the question of how to check links before opening them, the claims supported by these sources are limited. The table below lists them.
| Source | What it states |
|---|---|
| FTC consumer alert on QR codes at parking spots | Many QR readers show a preview of the link they will open. |
| FBI public service announcement on ic3.gov | Most phones have a built-in QR scanner in the camera app. |
| FBI public service announcement on ic3.gov | Tampered codes send victims to malicious sites that steal login and financial information. |
The source statements reviewed for this article do not include a checklist for reading a link. This article does not provide one either, so as not to go beyond what the sources say.
Official statements versus our interpretation
The angle of this explainer is to keep what the sources state apart from what we infer. The table below does that. The right-hand column is TribeAI's reading, not a statement from the FTC, the FBI or the NCSC.
| What a source states | Our interpretation (not a source claim) |
|---|---|
| Many QR readers show a preview of the link they will open (FTC). | Where a preview appears, it gives a moment to look at the link before opening it. The source does not say a preview is shown on every device. |
| Cybercriminals replace legitimate physical and digital codes with malicious ones (FBI). | A code on a public object or in a message is not necessarily the one its legitimate owner placed there. |
| Scammers have been reported covering codes on parking meters with their own (FTC). | A code at a parking meter may be worth a closer look before scanning. |
| Not every phishing email security tool scans images (NCSC). | An emailed QR code that reaches an inbox has not necessarily been checked by a filter. |
These interpretations are hypotheses for the reader to weigh. No experiment by TribeAI tested them, and none of the sources measures how well any of them works as a defense.
If money has already been sent after scanning a QR code
The FBI public service announcement states that law enforcement cannot guarantee that lost funds will be recovered after a transfer. That sentence sets expectations; it does not describe a recovery process.
The claims reviewed for this article do not cover reporting channels, bank procedures or timelines after a loss. Readers in Brazil dealing with a different kind of payment scam can see our explainer on getting money back after a Pix scam. That article covers a separate system and is not about QR code scams specifically.
Limits of this article
This article is educational information about QR code scams and quishing. It is not investment, legal or financial advice. It does not cover reporting procedures, recovery of lost funds, specific apps or devices, or detailed steps for reading a link. Where the sources stop, this article stops too.