FBI warns criminals tamper with QR codes: check posted payment and parking codes for stickers and confirm URLs

An FBI public service announcement says cybercriminals tamper with digital and physical QR codes to send victims to malicious sites that steal login and financial information, embed malware, or redirect payments. It advises checking the URL after scanning, looking for stickers over physical codes, and avoiding payment through sites reached by QR code.

Source facts

The FBI’s public service announcement on tampered QR codes says cybercriminals tamper with both digital and physical QR codes, replacing legitimate codes with malicious ones that direct victims to sites prompting for login and financial information. Malicious codes may also contain embedded malware, and a criminal can replace a business’s payment code to redirect the customer’s payment.

The FBI advises checking the URL after scanning to make sure it is the intended site, since a malicious domain may differ only by a typo or misplaced letter, and checking physical codes for tampering such as a sticker placed over the original. It also advises downloading apps from the phone’s app store rather than from a QR code, not installing separate QR scanner apps, and verifying codes that appear to come from someone known.

It recommends manually entering a known and trusted URL instead of paying through a site reached from a QR code, calling a company through a trusted number if an email says a payment can only be completed by QR code, and reporting losses to the local FBI field office and the Internet Crime Complaint Center. The FBI notes that law enforcement cannot guarantee recovery of lost funds.

Applicability

Use this for any organization that publishes QR codes or whose staff scan them. The announcement was published in 2022 under IC3 reference PSA220118; check IC3 for newer warnings.

DSE recommendation

DSE recommends inspecting every physical QR code the business posts on a schedule, and pointing payment codes only to a domain customers can recognize. Print the destination domain next to each code, mount codes behind glass or in tamper-evident holders where practical, add QR stickers to security patrol checklists, and never ask customers to pay by QR code from an email.

Verification

Scan each posted code monthly and confirm it resolves to the expected domain, record the check, and review customer payment complaints for signs of redirected payments.

Official reference

FBI Internet Crime Complaint Center — Cybercriminals Tampering with QR Codes to Steal Victim Funds (PSA220118). Reviewed October 18, 2026.