Why building codes are trusted
QR codes appear on intercoms, mailrooms, package lockers, amenity rooms, and access doors. They're part of daily life in a building, so residents rarely question them. Anyone with lobby access can add a code where residents expect a legitimate service.
A resident sees a code on a package locker saying a delivery is being held. The page asks for a fee and card number. Building management has no such system; the code was added by someone else. This is a composite example to show how the scam works, not a report of a specific incident.
Red flags for residents
- Codes on lockers or intercoms that management never announced.
- Delivery notices that don't match your carrier's app.
- Access pages that ask for personal information.
- Any code requesting payment for a service the property doesn't offer.
For property managers
Announce official codes through channels residents already trust, keep a record of where each code is placed, and inspect common areas regularly for added stickers. Use tamper-evident materials where possible, and encourage residents to report anything unfamiliar.
If you already scanned and entered something
Act quickly, but calmly:
- Close the page and do not re-enter anything.
- Change any password you typed, from a device you trust, and turn on two-factor authentication where you can.
- If a card or bank detail was involved, call your bank or card issuer and ask about disputing charges.
- Notify property management so they can remove the code and warn other residents.
- Report the destination link to Google Safe Browsing and, if money or identity was involved, to the FTC at reportfraud.ftc.gov.
For a fuller walkthrough, see I scanned a malicious QR code — what now?
Related guides: how to spot a fake sticker, what quishing is, and how to check a QR code.
Check it before you act
CheckThisQR decodes the code in your browser and shows the real destination and a safety verdict before you visit it. No account needed.
Check a QR code now →