QR code and payment link scams

QR-code (quishing) and payment-link scams hide a fake payment or login page behind a code or link.

How qr code and payment link scams work

You're asked to scan a QR code or tap a payment link to 'receive' a refund or 'verify' an account.

The code hides the destination, opening a fake payment or login page.

Receiving money never needs a scan, a PIN, or a link.

Common opening lines

• “Scan this QR code to receive your refund and confirm your details.”
• “Pay parking/fees by scanning this code.”
• “Scan to accept funds - enter your PIN to complete.”

Example patterns

Sanitised examples - placeholders only, never real links or data.

Red flags

• qr attachment
• payment request
• suspicious link

What to do now

1. Stop paying and keep the deal/communication on official channels.
2. If money moved, contact your bank or payment provider immediately.
3. Save evidence and report to your national cybercrime authority.

What not to do

• Don't pay a fee to receive money, a refund, a prize, or to 'release' funds.
• Don't pay via gift cards, wire, or crypto to someone you haven't verified.
• Don't trust payment screenshots as proof of payment.

If you already responded

If you went further: if you clicked, don't enter anything and change any details you typed; if you entered card details, freeze the card with your bank; if you shared an OTP, change the password and enable app-based 2FA; if you paid, contact your bank or provider immediately; if you installed an app or gave remote access, disconnect, uninstall, and change passwords from a clean device.

How to verify safely

Verify any payment inside your official banking/payment app; a QR code is never required to receive money.

How to report

Report through official channels you find yourself - never a number or link from the message. Tell your bank or payment provider if money moved, and file with your national fraud or cybercrime body. Find the right links in the reporting directory. Open the reporting directory.

Watch for 'recovery' offers afterwards: anyone promising to get your money back for an upfront fee is running a second scam.

Sources checked

• HHS HC3 - QR codes and phishing as a threat (white paper, 2023)
• FBI IC3 - Senior US officials impersonated in malicious messaging campaign (2025)

Last reviewed: 2026-06-05

This is general safety information, not legal, financial, or cybersecurity incident-response advice. We can't detect every scam or guarantee recovery - always verify through official channels.