Ticket QR codes
Resold or transferred tickets are a common vector: a forwarded screenshot or PDF containing a ticket QR code can just as easily contain a substituted or fraudulent one, especially when tickets change hands outside the platform's official transfer feature. If you're buying a resold ticket, verify it directly within the ticketing platform's own app — never trust a screenshot alone, regardless of how official it looks.
Badge and check-in codes
Conference badges and event check-in codes are typically bulk-generated ahead of time and often contain more than just an identifier — sometimes networking or contact-sharing data. A code from an unfamiliar or unofficial event app, or a "scan to connect" prompt from someone you haven't actually spoken with, deserves the same scrutiny as any other unsolicited QR code.
For event organizers
Much of our business QR safety guide applies directly here, with one addition specific to events: because attendee-facing codes are often printed and displayed in high-traffic, loosely supervised areas (registration desks, signage, sponsor booths) for the duration of a single event, physical tampering has a narrow but real window of opportunity. A quick visual check of public event signage each morning of a multi-day event is a low-effort habit that closes most of that window.
Treat that platform account the same way our static vs. dynamic QR codes guide describes — a compromised account can silently redirect every deployed code at once. Strong, unique credentials and two-factor authentication on that account matter as much as the physical signage.
How event QR scams typically work
Ahead of a festival, fans receive an email with a QR code for "exclusive backstage access". Scanning opens a page, styled with the festival's branding, that asks for card details to pay a "verification fee". The code was sent through an email list the real organizer never controlled. This is a composite example to show how the scam works, not a report of a specific incident.
Event codes are trusted because they are tied to something you paid for or were invited to. Attackers exploit that by cloning event pages or distributing fake codes through channels that look official.
Red flags for attendees
- A code sent by email or text from an address that does not match the organizer.
- Requests for payment beyond the original ticket price.
- Pages that ask for ID or Social Security numbers.
- Shortened links that do not resolve to the event's known domain when checked.
If you already scanned and entered something
Act quickly, but calmly:
- Close the page and do not re-enter anything.
- Change any password you typed, from a device you trust, and turn on two-factor authentication where you can.
- If a card or bank detail was involved, call your bank or card issuer and ask about disputing charges.
- Verify the event through its official site, not the code, and let the organizer know.
- Report the destination link to Google Safe Browsing and, if money or identity was involved, to the FTC at reportfraud.ftc.gov.
For a fuller walkthrough, see I scanned a malicious QR code — what now?
Check any event code first
A quick check takes seconds and costs nothing — free, no account needed.
Check a QR code →