Real QR Code Scam Examples

Where: Reported across multiple U.S. cities, including New York City. Source: NYC Department of Transportation alert, corroborated by the FTC's own September 2026 consumer alert on the same pattern.

Attack flow: Attackers print a QR code sticker matching the size and appearance of a city's official parking-payment code, and place it directly over the real one. Drivers scan it expecting to pay for parking, and land on a fraudulent payment page instead that collects their card details.

Warning signs: A sticker sitting slightly raised or misaligned; different paper stock than the surrounding meter signage; no visible city branding matching the rest of the meter.

What a scanner catches: A tool like CheckThisQR would catch the fraudulent payment page itself, once it's been reported to threat-intelligence databases — but a brand-new fake page may briefly evade detection before that happens. The physical inspection step (see our sticker-spotting guide) catches this earlier, before any check is even needed.

Takeaway: Combine a 5-second visual check with a safety check before paying — neither alone is sufficient.

Where: Documented as part of the same broader QR-tampering pattern the FTC has warned about generally, applied to table-tent and menu codes specifically.

Attack flow: A sticker placed over a legitimate table-tent or menu QR code redirects to a fake ordering or payment page designed to closely mimic the restaurant's real one, collecting payment details under the guise of placing an order.

Warning signs: A menu code that looks slightly different in print quality from the rest of the table material; a payment page that doesn't match the restaurant's actual branding or asks for unusual information (full card number when a tap-to-pay would normally suffice).

What a scanner catches: The same limitation as parking meters applies — detection depends on the fake page having already been reported. This is exactly why checking the destination domain against the restaurant's actual name matters as a first-line defense.

Takeaway: If a QR-based menu payment page doesn't clearly match the restaurant's name and branding, stop and ask a staff member before entering payment details.

Source: Documented broadly in security industry reporting on why QR codes are increasingly used specifically to evade automated filters (see our quishing explainer for the underlying statistics).

Attack flow: Rather than including a clickable phishing link (which email filters are generally good at catching as plain text), attackers embed the malicious link inside a QR code image within the email body or a PDF attachment. The email typically claims something needs "verification" — an account, a delivery, a multi-factor authentication setup — to create urgency.

Warning signs: Any unsolicited email or PDF asking you to scan a code rather than click a normal link is itself the red flag — legitimate services overwhelmingly use clickable links for email communication, not scannable images.

What a scanner catches: This is exactly the scenario a tool like CheckThisQR is most useful for — since the malicious link is hidden as an image, you can't preview it any other way before your phone's camera decodes it.

Takeaway: Treat any QR code arriving via email or a document as suspicious by default, regardless of how official the surrounding message looks.

Source: FTC consumer alert on unexpected package QR scams; the IRS separately added QR-code impersonation to its 2026 "Dirty Dozen" tax scam list.

Attack flow: Text messages or emails posing as shipping carriers, tax agencies, or the DMV, claiming a package couldn't be delivered or a payment is overdue, with a QR code to "resolve" the issue. A related variant: an unexpected physical package arrives containing a QR code claiming to reveal who sent a "gift" — actually a data-harvesting page.

Warning signs: The IRS explicitly states it never uses QR codes in official correspondence — any tax-related message with a QR code is automatically suspect. Legitimate shipping carriers also don't typically require scanning a code to resolve a delivery issue.

What a scanner catches: These pages are often short-lived and specifically built for one campaign, so detection can lag. The strongest defense here is simply knowing that government agencies don't operate this way at all.

Takeaway: Any QR code claiming to be from a government agency should be treated as fraudulent by default — verify directly through the agency's official website instead.