Got a Text With a QR Code? Here's How to Tell If It's a Scam

If a QR code arrived in a text message you were not expecting, assume it is a scam until proven otherwise. There is almost no legitimate reason for an organization to send you a QR code by SMS. You are already holding the phone. A normal business sends a link, or asks you to open its app. A code in a text exists mainly because a code slips past the filters that would flag a suspicious link.

This tactic has a name, quishing, and it has grown quickly because it works on people who are otherwise careful. Below is what the current versions look like, why the format is effective, and what to do if you already tapped.

The common versions right now

The stories change, but they all borrow urgency from something you plausibly have going on.

• Missed delivery. "Your package could not be delivered. Scan to reschedule." Effective because most people are waiting on something.
• Unpaid toll. "You have an outstanding toll of $6.99. Scan to avoid a late fee." The small amount is deliberate: it is cheap enough that paying feels easier than checking.
• Bank or account alert. "Suspicious login detected. Scan to verify your identity." This one wants your password and your one-time code, in that order.
• Refund or rebate. "You are owed a refund of $82.40. Scan to claim." Greed and fear work equally well as levers.
• Workplace message. "IT is migrating accounts. Scan to re-authenticate." Increasingly aimed at employees, because a work login is worth far more than a card number.

Why scammers use a QR code instead of a link

The switch to codes is a deliberate response to defenses that got better at catching links.

• Filters read text, not pictures. A suspicious URL in a message body can be flagged. The same URL encoded as an image often passes through untouched.
• You cannot preview it by looking. With a link you can at least read the domain. A code gives you nothing to inspect until you scan it.
• It moves you to a less protected device path. A code scanned from a work laptop screen often opens on a personal phone, outside whatever protections the employer has in place.
• It feels modern and official. Codes have become normal on parking meters, menus, and packaging, which lends them borrowed legitimacy.

How to tell a real message from a fake one

Four checks, none of which require you to scan anything.

1. Were you expecting it? An unprompted message about money, deliveries, or account access is the single strongest signal. Real problems with your accounts do not usually arrive first by text.
2. Does it manufacture urgency? Late fees, suspension warnings, and short deadlines exist to stop you thinking. Legitimate organizations give you time.
3. Check the sender. Scams often come from an ordinary mobile number, an email-to-SMS gateway, or a number in a country you have no relationship with. That said, sender numbers can be spoofed, so a plausible sender is not reassurance.
4. Go direct instead. Open the company's official app, or type the address yourself. If there is a real unpaid toll or a real delivery problem, it will be waiting for you there. If nothing is waiting, you have your answer.

What to do instead

Do not scan it. Do not reply, and do not send STOP: any response confirms your number is live and belonging to someone who reads their messages, which makes you more valuable to sell on.

• Report it. In the US, forward the message to 7726 (SPAM), which is free and goes to your carrier.
• Report to the FTC at reportfraud.ftc.gov.
• Block the sender, then delete the message.
• If it claimed to be from a company you do use, contact them through a number or app you already have, so they can confirm it was not them.

What to do if you already scanned it

Scanning alone is rarely the harmful step. What matters is what happened on the page that opened.

• You looked and closed it. Almost certainly fine. Close the tab.
• You entered a password. Change it on the real site immediately, and anywhere you reused it. Enable two-factor authentication.
• You entered card details. Call your bank or card issuer, report fraud, and have the card frozen or reissued. Then watch the statement for small test charges, which often precede larger ones.
• You entered a one-time code. This is the serious one, because it usually means someone was logging in as you at that moment. Change the password, sign out all active sessions, and check for new devices or forwarding rules on the account.
• It was a work account. Tell your IT or security team straight away, even if you are embarrassed. Speed matters far more than blame, and they would much rather hear it in the first ten minutes.
• You installed something. Remove it and restart the phone.

Frequently asked questions

Is it safe to scan a QR code from a text message?

Treat it as unsafe unless you specifically requested it and the sender is verified. The format exists in scam messages precisely because it evades the checks that catch suspicious links.

What happens if I scan a scam QR code?

Usually it opens a web page built to imitate a real one: a delivery tracker, a toll payment form, or a login screen. Nothing is stolen until you type something into it or approve something on it.

Can a QR code in a text install malware?

Not by scanning it. It can lead to a page that offers you a download or pushes you to install an app from outside the official stores. Declining that install is what protects you.

Why am I getting QR code texts at all?

Numbers get collected from breaches, public listings, and resold marketing lists, then messaged in bulk. It usually means your number appeared on a list, not that you were targeted personally.

Is a toll or delivery QR text ever real?

Tolling authorities and couriers overwhelmingly use their own apps, websites, or mailed notices. If in doubt, go to the official site directly rather than through anything in the message.

Not sure if a QR code is safe? Check it before you tap.

ScanLikely scans the code and warns you before it opens anything sketchy, links, fake payment pages, rogue WiFi, and more. Free on iPhone and Android.