Five common QR code scams

QR codes are fast and easy to create, making it even easier for cybercriminals to steal your information or load malware onto your device. Here are some common QR code scams that you should lookout for.

Microsoft Defender

Stay safer online with one easy-to-use app<sup>1

1</sup>Microsoft 365 Personal or Family subscription required; app available as separate download

Learn more

1. QR code email scams

Scammers often send phishing emails that contain QR codes. This technique is known as “quishing.” These emails will pose as a credible company and ask you to scan the QR code in their email. For example, they may say that your payment from an online purchase didn’t go through, and you need to re-enter your credit card information by scanning the QR code. Unsuspecting victims will scan the QR code, enter a legitimate-looking website, and enter their payment information. Now, the cybercriminal has access to their credit card information.

2. QR code payment scams

QR codes can be used for contactless payments by legitimate businesses. Using QR codes for payments was extremely popular during the height of the COVID-19 pandemic since it allowed customers to make purchases without touching card readers, minimizing the spread of germs. However, scammers can place QR codes in public places to steal your money or credit card information. For example, criminals have placed signs in parking lots telling people that they can pay for parking by scanning the QR code. The QR code would take drivers to a website to pay for their parking that looked legitimate but wasn’t.

3. QR code package scams

If you ever receive a suspicious package in the mail with a QR code, don’t scan it. In this type of QR code scam, criminals will send you a package in the mail that you never ordered. There’s a QR code inside the package (or on the box) that you can scan to get more information about the order or to return your order. The QR code will take you to website that prompts you to enter your personal information, like your credit card number.

4. QR code cryptocurrency scams

QR codes are often used for crypto transactions. However, criminals can use QR codes to steal cryptocurrency from victims. They may contact you offering a “giveaway” that says you can get double the crypto if you send them crypto first. However, you’ll never get any crypto back. Scammers may also invite you in on an “investment” and ask you to send them crypto. These scammers run away with your crypto and you’ll likely never hear from them again.

5. QR code donation scams

Scammers may impersonate a charity or create a fake charity to steal your money or credit card information. They may place QR codes on flyers or send them to you through text or email asking you donate money to a cause.

How you can avoid QR code scams

Follow these tips to avoid becoming a victim of QR code scams:

• Preview the QR code link. A preview of the URL should appear on your phone when you scan a QR code. Make sure the URL seems legitimate and that it isn’t a misspelling of a real URL (for example, “Microsaft.com” instead of “Microsoft.com”).
• Check for tampering. If you’re scanning a QR code that’s in a public place, like a restaurant, make sure the QR code doesn’t have a sticker above it that a scammer could have placed.
• Check the website. If you follow the QR code link, ask yourself if the website seems professional. Low-quality images and typos are signs of fraudulent websites. Look for a lock symbol next to the URL or https:// in the URL. These URLs are secure URLs.
• When in doubt, contact the company. If you receive an unusual email or letter in the mail from a business with a QR code, contact the business to determine if the message is legitimate.
• Don’t scan or open QR codes from strangers. Whether you’re approached online or in the street, don’t scan QR codes from people that you don’t know. Be on the lookout for “too good to be true” messages, like a stranger offering you money or free products if you scan their QR code.

What to do if you’re a victim of a QR code scam

If you’ve entered your information into a fraudulent QR code website, here’s what you can do:

• Change your passwords. If you used your login information on a fraudulent website, make sure to change your password. It’s also wise to set up two-factor authentication on your accounts.
• Contact your bank. If you entered your credit card information on a fraudulent website, let your bank know. Freeze your account and work with your bank to take further steps to protect your finances.
• Report it. You can report a QR code scam through the Federal Trade Commission.

Understanding the potential dangers of QR codes will help you avoid scams. Learn more ways you can protect your privacy with Microsoft 365.