Parking meter stickers

Attackers print a QR code sticker that looks identical to a city's official parking-payment code and place it directly over the real one. Drivers scan it expecting to pay for parking, and are instead taken to a fraudulent payment page that collects their card details. This has been reported across multiple U.S. cities — New York City's Department of Transportation specifically issued a warning after discovering fraudulent QR codes placed directly on parking meters.

Restaurant and retail menu codes

A sticker placed over a legitimate table-tent or menu QR code redirects to a fake ordering or payment page designed to closely mimic the restaurant's real one — collecting payment details under the guise of placing an order.

Email and PDF phishing

Rather than including a clickable phishing link (which email filters are generally good at catching), attackers embed the malicious link inside a QR code image within the email body or a PDF attachment. The email typically claims something needs "verification" — an account, a delivery, a multi-factor authentication setup — to create urgency.

Fake delivery and government notices

Text messages or emails posing as shipping carriers, tax agencies, or the DMV, claiming a package couldn't be delivered or a payment is overdue, with a QR code to "resolve" the issue. These rely on urgency and the appearance of an official notice to override caution.

The common thread

Every one of these scams counts on the same thing: the moment between scanning and acting is compressed, because a QR code feels more like a physical action (like reading a menu) than a decision (like clicking a link). Slowing down at that exact moment is the single most effective defense.

What to do