An FBI public service announcement says cybercriminals tamper with digital and physical QR codes to send victims to malicious sites that steal login and financial information, embed malware, or redirect payments. It advises checking the URL after scanning, looking for stickers over physical codes, and avoiding payment through sites reached by QR code.
\nThe FBI’s public service announcement on tampered QR codes says cybercriminals tamper with both digital and physical QR codes, replacing legitimate codes with malicious ones that direct victims to sites prompting for login and financial information. Malicious codes may also contain embedded malware, and a criminal can replace a business’s payment code to redirect the customer’s payment.
\nThe FBI advises checking the URL after scanning to make sure it is the intended site, since a malicious domain may differ only by a typo or misplaced letter, and checking physical codes for tampering such as a sticker placed over the original. It also advises downloading apps from the phone’s app store rather than from a QR code, not installing separate QR scanner apps, and verifying codes that appear to come from someone known.
\nIt recommends manually entering a known and trusted URL instead of paying through a site reached from a QR code, calling a company through a trusted number if an email says a payment can only be completed by QR code, and reporting losses to the local FBI field office and the Internet Crime Complaint Center. The FBI notes that law enforcement cannot guarantee recovery of lost funds.
\nUse this for any organization that publishes QR codes or whose staff scan them. The announcement was published in 2022 under IC3 reference PSA220118; check IC3 for newer warnings.
\nDSE recommends inspecting every physical QR code the business posts on a schedule, and pointing payment codes only to a domain customers can recognize. Print the destination domain next to each code, mount codes behind glass or in tamper-evident holders where practical, add QR stickers to security patrol checklists, and never ask customers to pay by QR code from an email.
\nScan each posted code monthly and confirm it resolves to the expected domain, record the check, and review customer payment complaints for signs of redirected payments.
\nFBI Internet Crime Complaint Center — Cybercriminals Tampering with QR Codes to Steal Victim Funds (PSA220118). Reviewed October 18, 2026.
", "content_text": "An FBI public service announcement says cybercriminals tamper with digital and physical QR codes to send victims to malicious sites that steal login and financial information, embed malware, or redirect payments. It advises checking the URL after scanning, looking for stickers over physical codes, and avoiding payment through sites reached by QR code.\nSource facts\nThe FBI’s public service announcement on tampered QR codes says cybercriminals tamper with both digital and physical QR codes, replacing legitimate codes with malicious ones that direct victims to sites prompting for login and financial information. Malicious codes may also contain embedded malware, and a criminal can replace a business’s payment code to redirect the customer’s payment.\nThe FBI advises checking the URL after scanning to make sure it is the intended site, since a malicious domain may differ only by a typo or misplaced letter, and checking physical codes for tampering such as a sticker placed over the original. It also advises downloading apps from the phone’s app store rather than from a QR code, not installing separate QR scanner apps, and verifying codes that appear to come from someone known.\nIt recommends manually entering a known and trusted URL instead of paying through a site reached from a QR code, calling a company through a trusted number if an email says a payment can only be completed by QR code, and reporting losses to the local FBI field office and the Internet Crime Complaint Center. The FBI notes that law enforcement cannot guarantee recovery of lost funds.\nApplicability\nUse this for any organization that publishes QR codes or whose staff scan them. The announcement was published in 2022 under IC3 reference PSA220118; check IC3 for newer warnings.\nDSE recommendation\nDSE recommends inspecting every physical QR code the business posts on a schedule, and pointing payment codes only to a domain customers can recognize. Print the destination domain next to each code, mount codes behind glass or in tamper-evident holders where practical, add QR stickers to security patrol checklists, and never ask customers to pay by QR code from an email.\nVerification\nScan each posted code monthly and confirm it resolves to the expected domain, record the check, and review customer payment complaints for signs of redirected payments.\nOfficial reference\nFBI Internet Crime Complaint Center — Cybercriminals Tampering with QR Codes to Steal Victim Funds (PSA220118). Reviewed October 18, 2026.", "content_markdown": "An FBI public service announcement says cybercriminals tamper with digital and physical QR codes to send victims to malicious sites that steal login and financial information, embed malware, or redirect payments. It advises checking the URL after scanning, looking for stickers over physical codes, and avoiding payment through sites reached by QR code.\n\n## Source facts\n\nThe FBI’s [public service announcement on tampered QR codes](https://www.ic3.gov/PSA/2022/PSA220118) says cybercriminals tamper with both digital and physical QR codes, replacing legitimate codes with malicious ones that direct victims to sites prompting for login and financial information. Malicious codes may also contain embedded malware, and a criminal can replace a business’s payment code to redirect the customer’s payment.\n\nThe FBI advises checking the URL after scanning to make sure it is the intended site, since a malicious domain may differ only by a typo or misplaced letter, and checking physical codes for tampering such as a sticker placed over the original. It also advises downloading apps from the phone’s app store rather than from a QR code, not installing separate QR scanner apps, and verifying codes that appear to come from someone known.\n\nIt recommends manually entering a known and trusted URL instead of paying through a site reached from a QR code, calling a company through a trusted number if an email says a payment can only be completed by QR code, and reporting losses to the local FBI field office and the Internet Crime Complaint Center. The FBI notes that law enforcement cannot guarantee recovery of lost funds.\n\n## Applicability\n\nUse this for any organization that publishes QR codes or whose staff scan them. The announcement was published in 2022 under IC3 reference PSA220118; check IC3 for newer warnings.\n\n## DSE recommendation\n\nDSE recommends inspecting every physical QR code the business posts on a schedule, and pointing payment codes only to a domain customers can recognize. Print the destination domain next to each code, mount codes behind glass or in tamper-evident holders where practical, add QR stickers to security patrol checklists, and never ask customers to pay by QR code from an email.\n\n## Verification\n\nScan each posted code monthly and confirm it resolves to the expected domain, record the check, and review customer payment complaints for signs of redirected payments.\n\n## Official reference\n\n[FBI Internet Crime Complaint Center — Cybercriminals Tampering with QR Codes to Steal Victim Funds (PSA220118)](https://www.ic3.gov/PSA/2022/PSA220118). Reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/fbi-ic3-tampered-qr-codes-payment-signage-stickers-business-checks/", "url": "https://update.dsesecurity.com/updates/fbi-ic3-tampered-qr-codes-payment-signage-stickers-business-checks/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/fbi-ic3-tampered-qr-codes-payment-signage-stickers-business-checks/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "FBI warns criminals tamper with QR codes: check posted payment and parking codes for stickers and confirm URLs", "item": "https://update.dsesecurity.com/updates/fbi-ic3-tampered-qr-codes-payment-signage-stickers-business-checks/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/fbi-ic3-tampered-qr-codes-payment-signage-stickers-business-checks/#article", "identifier": "https://update.dsesecurity.com/updates/fbi-ic3-tampered-qr-codes-payment-signage-stickers-business-checks/", "url": "https://update.dsesecurity.com/updates/fbi-ic3-tampered-qr-codes-payment-signage-stickers-business-checks/", "headline": "FBI warns criminals tamper with QR codes: check posted payment and parking codes for stickers and confirm URLs", "description": "An FBI public service announcement says cybercriminals tamper with digital and physical QR codes to send victims to malicious sites that steal login…", "abstract": "An FBI public service announcement says cybercriminals tamper with digital and physical QR codes to send victims to malicious sites that steal login and financial information, embed malware, or redirect payments. It advises checking the URL after scanning, looking for stickers over physical codes, and avoiding payment through sites reached by QR code.", "articleBody": "An FBI public service announcement says cybercriminals tamper with digital and physical QR codes to send victims to malicious sites that steal login and financial information, embed malware, or redirect payments. It advises checking the URL after scanning, looking for stickers over physical codes, and avoiding payment through sites reached by QR code.\nSource facts\nThe FBI’s public service announcement on tampered QR codes says cybercriminals tamper with both digital and physical QR codes, replacing legitimate codes with malicious ones that direct victims to sites prompting for login and financial information. Malicious codes may also contain embedded malware, and a criminal can replace a business’s payment code to redirect the customer’s payment.\nThe FBI advises checking the URL after scanning to make sure it is the intended site, since a malicious domain may differ only by a typo or misplaced letter, and checking physical codes for tampering such as a sticker placed over the original. It also advises downloading apps from the phone’s app store rather than from a QR code, not installing separate QR scanner apps, and verifying codes that appear to come from someone known.\nIt recommends manually entering a known and trusted URL instead of paying through a site reached from a QR code, calling a company through a trusted number if an email says a payment can only be completed by QR code, and reporting losses to the local FBI field office and the Internet Crime Complaint Center. The FBI notes that law enforcement cannot guarantee recovery of lost funds.\nApplicability\nUse this for any organization that publishes QR codes or whose staff scan them. The announcement was published in 2022 under IC3 reference PSA220118; check IC3 for newer warnings.\nDSE recommendation\nDSE recommends inspecting every physical QR code the business posts on a schedule, and pointing payment codes only to a domain customers can recognize. Print the destination domain next to each code, mount codes behind glass or in tamper-evident holders where practical, add QR stickers to security patrol checklists, and never ask customers to pay by QR code from an email.\nVerification\nScan each posted code monthly and confirm it resolves to the expected domain, record the check, and review customer payment complaints for signs of redirected payments.\nOfficial reference\nFBI Internet Crime Complaint Center — Cybercriminals Tampering with QR Codes to Steal Victim Funds (PSA220118). Reviewed October 18, 2026.", "datePublished": "2026-10-18T21:01:31+00:00", "dateModified": "2026-10-18T22:22:09+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/fbi-ic3-tampered-qr-codes-payment-signage-stickers-business-checks/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/fbi-ic3-tampered-qr-codes-payment-signage-stickers-business-checks/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "FBI warns criminals tamper with QR codes: check posted payment and parking codes for stickers and confirm URLs" }, "articleSection": [ "Business Continuity", "Cybersecurity" ], "keywords": [ "Business Continuity", "Cybersecurity", "Guide", "Advisory priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" } ], "wordCount": 396, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "FBI Internet Crime Complaint Center — Cybercriminals Tampering with QR Codes to Steal Victim Funds (PSA220118)", "url": "https://www.ic3.gov/PSA/2022/PSA220118" } } ] } }