The menu at your favorite restaurant is a QR code taped to the table. You pointed your camera at it, tapped the link, and never gave it a second thought. That is exactly what QR code scammers are counting on.
The FBI warned about tampered QR codes back in January 2022, and the advice still holds. This tip walks through the habits it recommends.
What the FBI warned about
Criminals tamper with QR codes so that a victim scans what looks like a legitimate code and lands on a malicious site instead. From there, the site may ask for login details, payment information, or other sensitive data. The FBI also noted that some fraudulent codes can install malware that reaches passwords and banking information.
The trick works because you cannot read a QR code. It looks the same whether it leads to the menu or to a lookalike page.
Habits that help
The FBI's list boils down to a few checks you can do in seconds. Look at the address that shows up after you scan and make sure it is spelled correctly. If the code is on a sign or table, check that no one has stuck another code over the top of the real one. Use your phone's built-in camera to scan, not a separate scanner app you downloaded.
Avoid paying through a QR code when you can type in a trusted web address yourself. If a message or an invoice asks you to scan to pay, call the company on a number you already know and confirm it first. The same goes for a code a coworker or friend sends you. Ask them through another channel if they meant to.
For business owners
If your business puts QR codes on menus, flyers, invoices, or yard signs, check them on a schedule. A sticker over your code is a free attack on your customers with your name on it. Print the web address in plain sight next to every code so people can type it instead.
The bigger lesson
A QR code is a link you cannot read. Treat it like an unknown link in an email, because that is what it is. Getting staff to apply the same caution to codes, texts, and email is part of the awareness training we include with our managed IT services.
A QR code is a link you cannot read. We train staff to spot the ones that are not what they seem and lock down the accounts behind them. No pressure, no obligation, just a straight look at your setup.
Book a 10-Minute Discovery Call →Frequently asked questions
Are QR codes dangerous?
The code itself is just a link. The risk is where it sends you, and that is easy to tamper with, so check the address before you enter anything.
How can I tell if a QR code has been tampered with?
Look for a sticker placed over the original code, and check that the address shown after scanning is spelled correctly. If anything looks off, do not continue.
Should I use a QR scanner app?
The FBI recommends using your phone's built-in camera instead of downloading a separate scanner app.
What do I do if I already scanned a bad code?
Do not enter any information. If you did, change the affected passwords right away, contact your bank if payment details were involved, and report it to IT. You can also file a report at ic3.gov.
Can safemode IT train our staff on scams like this?
Yes. Short, practical training is part of how we help clients. See our managed IT services or ask for a free assessment.
Source: NBC Chicago, FBI warns of QR code scam (January 2022)
Last updated: October 29, 2026
