Why travel codes are trusted

Travel QR codes appear on room keys, concierge desks, amenity cards, airport kiosks, and rental agreements. People trust them because they sit inside a controlled environment — a hotel room feels like a safe place to scan. Attackers rely on that assumption by placing or swapping codes in spaces where guests expect legitimate services.

Illustrative scenario

A guest finds a card in the room offering spa bookings through a QR code. The page asks for a card number to reserve a slot. The hotel has no such online system, and the card was left by a third party. This is a composite example to show how the scam works, not a report of a specific incident.

Red flags while traveling

  • A code in a guest room that wasn't there at check-in.
  • Amenity offers that require payment on an unfamiliar page.
  • Airport or rental-car codes that don't match the company's official app.
  • Any code asking for passport or ID numbers.
  • Pages whose address doesn't match the hotel or company you expect.

Safer habits on the road

Ask the front desk whether a code is genuine before you scan it. Use the hotel's or airline's official app for bookings and payments rather than a code you found. On public Wi-Fi, be extra cautious about entering any password or card number.

If you already scanned and entered something

Act quickly, but calmly:

  • Close the page and do not re-enter anything.
  • Change any password you typed, from a device you trust, and turn on two-factor authentication where you can.
  • If a card or bank detail was involved, call your bank or card issuer and ask about disputing charges.
  • Alert the hotel front desk or the rental company so they can remove the code.
  • Report the destination link to Google Safe Browsing and, if money or identity was involved, to the FTC at reportfraud.ftc.gov.

For a fuller walkthrough, see I scanned a malicious QR code — what now?

Related guides: how to spot a fake sticker, what quishing is, and how to check a QR code.

Next step

Check it before you act

CheckThisQR decodes the code in your browser and shows the real destination and a safety verdict before you visit it. No account needed.

Check a QR code now →