Why fuel and charging codes are targeted
Fuel and charging QR codes are targeted because drivers expect to pay and want to be quick. An attacker doesn't need to touch the real terminal; they can add a code nearby that promises convenience or savings and leads to a page collecting card details.
A driver at a charging station notices a sticker offering a "discounted rate" through a QR code. The page asks for card details. The real charging interface is untouched; the sticker was simply added beside it. This is a composite example to show how the scam works, not a report of a specific incident.
Red flags at the pump or charger
- Codes near, but not on, the official payment terminal.
- Offers of discounts or faster service through an unfamiliar page.
- Pages that don't match the charging network's app.
- Any code asking for card details outside the normal payment flow.
Safer ways to pay
Use the network's official app (installed from your phone's app store, not from a code), or pay at the terminal. If you want to check a code anyway, decode it first and compare the domain with the network's real site.
If you already scanned and entered something
Act quickly, but calmly:
- Close the page and do not re-enter anything.
- Change any password you typed, from a device you trust, and turn on two-factor authentication where you can.
- If a card or bank detail was involved, call your bank or card issuer and ask about disputing charges.
- Report the code to the charging network or station operator so it can be removed.
- Report the destination link to Google Safe Browsing and, if money or identity was involved, to the FTC at reportfraud.ftc.gov.
For a fuller walkthrough, see I scanned a malicious QR code — what now?
Related guides: how to spot a fake sticker, what quishing is, and how to check a QR code.
Check it before you act
CheckThisQR decodes the code in your browser and shows the real destination and a safety verdict before you visit it. No account needed.
Check a QR code now →