Common QR code fraud examples include fake stickers on parking meters, bogus parcel delivery notices, emails asking you to scan a code to "verify" your account, and flyers promising prizes or discounts. They all aim to send you to a fake page that steals logins, card details or money. Check the link before you open it.
QR codes are convenient because you do not have to type anything. Criminals like them for the same reason: you cannot read a QR code with your eyes, so it is easy to hide a dangerous link inside one. Below are the scenarios people most often run into, what makes each one convincing, and the warning signs to look for.
Payment scams in public places
Fake stickers on parking meters and charging points
How it works: A fraudster prints a QR code and sticks it over, or next to, the real code on a parking meter, car park sign or electric vehicle charger. The fake code leads to a payment page that looks official. You enter your card details to pay for parking, and the criminal keeps them.
Warning signs:
- A sticker that looks newer, thicker, misaligned or slightly different from the rest of the sign
- A web address that does not match the official parking operator or city council
- A page that asks for more than payment, such as your full card PIN or ID number
- Unexpected "processing fees" or subscription offers
Safer habit: Use the official parking app or the website printed on the sign itself, typed by hand, rather than an unknown code.
Fake payment QR codes in shops and markets
How it works: A criminal places their own payment QR code over a shop's real code at the till or on a market stall. Customers pay, but the money goes to the wrong account. With payment apps that support it, such as PromptPay, checking the receiver name before confirming is the key defence. Read more in our guide to QR payment safety.
Warning signs:
- The receiver name in your banking app does not match the shop
- The code sticker looks added on top of another one
- Staff seem unaware of the code you are scanning
Safer habit: Always check the receiver name and amount in your banking app before you confirm.
Scams that arrive by post and email
Parcel delivery notices
How it works: A card is left in your mailbox, or a message arrives, saying a parcel could not be delivered. A QR code takes you to a page asking for a small "redelivery fee" or to "confirm your address". The real goal is your card details or personal information.
Warning signs:
- You are not expecting a parcel, or the notice does not name a sender
- A small fee is requested urgently
- The courier's name is spelled slightly wrong or the logo looks off
- The link uses an unusual domain rather than the courier's official website
Safer habit: Track parcels using the tracking number from the shop where you ordered, or the courier's official app.
Phishing emails with a QR code
How it works: An email claims to come from your bank, IT department or a well-known service. It says your password is expiring, a document is waiting, or your account will be locked, and asks you to scan a QR code. Scanning moves you from a work computer with security filters to your personal phone, where the fake login page is harder to spot. We cover this in detail in our guide to QR code phishing emails.
Warning signs:
- Pressure to act quickly, often within hours
- A QR code where a normal link would make more sense
- A sender address that does not match the organisation
- A login page reached through a QR code instead of the address you normally use
Safer habit: Open the service yourself, by typing its address or using its official app, and check your account there.
Flyers, posters and fake codes in shared spaces
Flyers, posters and "free gift" offers
How it works: Flyers on cars, posters in public places or leaflets in shops promise discounts, free gifts, prize draws or jobs. The QR code leads to a page that collects personal details, asks you to install an app, or charges a small "shipping fee" for a prize.
Warning signs:
- An offer that seems too generous
- Requests for ID numbers, bank details or one-time passwords
- Prompts to download an app from outside the official app store
- No clear company name, address or contact details
Safer habit: If the offer is real, you can usually find it on the company's official website or social media.
Codes in restaurants, hotels and public Wi-Fi signs
How it works: Less common but possible: a fake menu code or "free Wi-Fi" code is placed on a table or wall. It leads to a page asking you to sign in with a social media or email account, or to pay before seeing the menu.
Warning signs: a menu or Wi-Fi page that asks for a password to another service, or for payment details before you have ordered anything.
A quick checklist before you scan any QR code
These checks work for every scenario above:
- Look at the code. Is it a sticker placed over something else?
- Ask whether the code makes sense here. Why would a parking meter or email need you to scan?
- Preview the link before opening it, and read the domain name carefully.
- Be extra careful with short links that hide the real destination.
- Never enter passwords, one-time codes or card details on a page you reached from an unexpected code.
- When in doubt, go to the official website or app yourself.
Our longer guide, 10 checks before you scan a QR code, goes deeper into each step.
FAQ
What is the most common QR code scam?
Fake payment and login pages are the most common goals. They appear in many forms, including stickers on parking meters, delivery notices and phishing emails, but they all try to collect your details or money.
How can I tell if a QR code is fake?
Check whether it is a sticker placed over another code, preview the web address before opening it, and confirm that the domain belongs to the organisation you expect.
What should I do if I entered my details on a fake page?
Contact your bank straight away if you entered card or banking details, change any passwords you typed, and turn on two-step sign-in. Our guide on what to do after you scanned a malicious QR code walks you through each step.
Are QR code scams reported to the police?
Yes, you can report fraud to the police and to your bank. Consumer-protection agencies in many countries also collect reports and issue general warnings about current scams.
Check before you trust
Most QR code fraud relies on people opening a link without looking. Before opening an unfamiliar code, scan it with the QR-TH online QR scanner, which shows the destination first so you can decide calmly whether it is safe to continue.