A QR code shows up somewhere ordinary: taped to a package you weren’t expecting, embedded in a text about a traffic violation, printed on a flyer. You scan it out of habit, the same way you’d tap a link. That habit is exactly what this QR code scam depends on, and the FTC has issued two separate consumer alerts on it in the past year and a half.
THE TWO SCAMS THE FTC HAS ACTUALLY CONFIRMED
In January 2025, the FTC warned about QR codes showing up on packages you didn’t order. Scanning one can lead to a phishing page designed to steal your personal information, or in some cases install malware on your phone. In April 2026, the FTC issued a second alert about text messages claiming you have an unpaid traffic violation, complete with a fake case number and a QR code to “resolve it now.” Both scams follow the same core move: create urgency, then hand you a QR code instead of a normal link, because a QR code hides its destination until you’ve already scanned it.
WHY A QR CODE IS HARDER TO VET THAN A LINK
With a text link, you can at least glance at the URL before tapping it. A QR code shows you nothing until your phone has already decoded it and started to open it. That’s not an accident. It’s the exact reason scammers switched to QR codes for these campaigns: it removes the one habit (skim the link first) that catches most other scam texts.
WHAT TO DO INSTEAD
Don’t scan a QR code that arrives in an unexpected text or email, especially one urging you to act immediately. If a package shows up with a QR code and you don’t remember ordering anything, don’t scan it. If you get a text about a traffic violation or court case, don’t use the QR code at all. Go directly to the court’s actual website, or call using a phone number you look up independently, not one from the text.
WHAT ABOUT QR CODES IN PUBLIC PLACES
Scam QR stickers placed over legitimate codes, on parking meters, menus, and payment kiosks, have been widely reported by local news outlets and city agencies, even though it’s not yet the subject of its own federal alert. The same rule applies regardless: if a QR code is asking you to pay for something, check that the destination matches who you’d expect (the actual parking app, the actual restaurant’s ordering system) before entering any payment information.
THE BOTTOM LINE
A QR code is not more trustworthy than a regular link. It’s less transparent, which is exactly why scammers are using it. Treat any unexpected QR code the way you’d treat an unexpected link: don’t scan it, and if you need to handle whatever it’s claiming to be about, go there yourself through a source you already trust.