Consumer Protection Tuesday: How to Spot and Avoid QR Code Scams
Tl;dr: QR codes are everywhere, from restaurant menus to payment apps, but scammers are increasingly using them to steal your personal and financial information. In this blog, we break down how QR code scams work, common red flags to look for, and what you can do to protect your assets when scanning a code.
This post is part of a weekly Tuesday series at Coinbase about the latest consumer protection and security measures for crypto owners.
At Coinbase, we’re on a mission to help update the financial system to make it safer and more secure. While only 0.14% of blockchain transactions are used for illicit activity, and cash remains the preferred medium for illegal transactions, crypto security is always a top priority. Coinbase maintains a robust compliance program, which includes Know Your Customer (KYC) checks, sanctions screenings, suspicious activity reporting, and strong law enforcement partnerships to detect and prevent illicit activity on our platform.
QR Codes Are Convenient But Not Always Safe
QR (Quick Response) codes have become a standard tool for accessing links, making payments, and sharing information. They’re fast, easy, and require no physical contact.
But that same convenience is now being exploited by scammers. Cybercriminals are placing fake QR codes in public places, sending malicious codes via text or email, and using them to redirect victims to phishing sites or fake crypto wallets.
The simplicity of scanning a code masks the risks behind it. That’s why knowing how to identify a suspicious QR code, and understanding the tactics behind these scams, is essential.
Four Common Types of QR Code Scams to Watch For
1. Imposter QR Codes in Public Places
Scammers place counterfeit QR code stickers over legitimate ones, on parking meters, restaurant tables, or public signs. When scanned, these codes redirect to fake payment sites or malware-laced links.
Stay safe: Check for tampering. If the QR code looks like a sticker or seems out of place, don’t scan it.
2. Crypto “Giveaway” QR Scams
Victims receive a message or see a post advertising a crypto giveaway or urgent account warning. They’re asked to scan a QR code that leads to a convincing, but fake, login page.
Stay safe: Never enter login info or recovery phrases from a QR code link. No real platform will ever ask you to do this.
3. Malware Downloads from QR Scans
Some QR codes trigger automatic downloads when scanned. These could contain malicious apps that spy on your activity or compromise your device and crypto wallets.
Stay safe: Don’t install anything prompted by a QR code. Only download apps directly from verified app stores.
4. Urgent Messages Involving QR Codes
Scammers pretend to be from your bank, a tech company, or a government agency and send you a QR code to scan “urgently.” These links typically request a payment or access to your private data.
Stay safe: Pause and verify. No real agency or bank will ever tell you to scan a QR code to resolve an emergency.
How to Stay Safe When Scanning QR Codes
Preview the URL: Most phones will show the full URL before opening a scanned QR code. Look for typos, strange domains, or misspelled names.
Avoid scanning codes from unknown sources: Never scan a QR code sent by a stranger or found in a public place unless you can verify the source.
Double-check merchant details: If you're using a QR code to make a payment, verify the merchant's name on your screen matches the intended recipient.
Enable multi-factor authentication (MFA): Add an extra layer of security in case you ever enter your credentials on a fraudulent site.
Talk to someone you trust: If you're unsure, pause and consult a friend, family member, or professional before taking action.
Think Before You Scan
QR codes are a convenient tool, but like any technology, they can be manipulated. Staying informed and cautious is the best way to avoid QR code scams and protect your crypto and financial assets.
Remember: If a QR code is urging you to act fast, send money, or enter private information, take a step back. Scammers rely on pressure and panic. Your best defense is education and awareness.
Coinbase will NEVER ask you to scan a QR code to fix an issue or send crypto. Stay safe, stay alert, and share these tips with your loved ones.
