Why retail codes get targeted
QR codes show up on shelf labels, price tags, loyalty cards, and promotional displays. They're trusted because they're part of the shopping experience. An attacker can swap a label or add a convincing look-alike that mimics store branding and points to a fake coupon or loyalty page.
A shopper scans a shelf-label code that promises a coupon. The page asks for card details to "activate" the savings. The code was added to the label by someone other than the store. This is a composite example to show how the scam works, not a report of a specific incident.
Red flags in a store
- Codes on labels that look different from the surrounding ones.
- Offers that seem too good to be true.
- Pages asking for loyalty numbers or card details outside the store's normal flow.
- Codes placed near high-value items such as electronics or gift cards.
What to do instead
Use the retailer's official app to find coupons and loyalty offers. If you want to check a code in the aisle, photograph it and decode it with CheckThisQR before opening the link — see scanning from a photo. Let a staff member know if a label looks tampered with.
If you already scanned and entered something
Act quickly, but calmly:
- Close the page and do not re-enter anything.
- Change any password you typed, from a device you trust, and turn on two-factor authentication where you can.
- If a card or bank detail was involved, call your bank or card issuer and ask about disputing charges.
- Tell store staff so they can check the other labels.
- Report the destination link to Google Safe Browsing and, if money or identity was involved, to the FTC at reportfraud.ftc.gov.
For a fuller walkthrough, see I scanned a malicious QR code — what now?
Related guides: how to spot a fake sticker, what quishing is, and how to check a QR code.
Check it before you act
CheckThisQR decodes the code in your browser and shows the real destination and a safety verdict before you visit it. No account needed.
Check a QR code now →