QR codes are everywhere now — on restaurant menus, posters, bills, and parking machines. You point your phone’s camera at the little square, and a website opens.
That convenience is exactly what scammers count on. You can’t tell where a QR code goes just by looking at it, and a fake one looks identical to a real one. Using fake QR codes to steal information is sometimes called quishing.
Where Fake QR Codes Show Up
The Canadian Bankers Association describes two main ways these scams work:
- In emails and messages — a QR code with a warning about a payment problem or an account about to close. Scanning it takes you to a fake website or a harmful app.
- In public places — a QR code posted to look like an official notice, which collects your personal and payment information when you scan it.
This is happening close to home. In April 2026, the City of Mississauga warned that fraudulent QR code stickers had appeared on downtown parking machines, sending people to payment sites that had nothing to do with the City. The City was clear: QR codes will never be placed on its parking machines or used to pay for parking.
How to Scan Safely
Look for a sticker
Before you scan a QR code in public, look at it closely. If it looks like a sticker stuck on top of something — or on top of another code — don’t scan it.
Check the web address before you tap
When you point your camera at a QR code, most phones show the web address before opening it. Read it. If it doesn’t match the business or organization you expect — or it’s a jumble of letters — don’t open it.
Don’t scan codes that arrive out of the blue
A QR code in an unexpected email, text, or letter deserves the same suspicion as a link. If it says there’s a problem with your account, go to the company yourself — type their website, use their app, or call the number on your card or a real bill.
Pay the way you know
For parking, bills, and other payments, use the machine’s own screen, the official app you already have, or the website you type yourself. If a QR code seems to be the only way to pay, check with the business or city directly first.
⚠ The warning signs
A QR code that looks like a sticker, or sits on top of another code.
A QR code that arrives with urgent news about a payment or your account.
A website that asks for your card number or password right after you scan.
If You Already Scanned and Paid
- Call your credit card company or bank right away, using the number on the back of your card.
- Watch your statements for charges you don’t recognize.
- Report it — to the business or city whose sign was tampered with, to your local police, and to the Canadian Anti-Fraud Centre at 1-888-495-8501.
✓ A rule worth keeping
A QR code is just a link you can’t read. Treat it the same way: when in doubt, don’t scan — go to the website yourself.
⚠ Disclaimer
This article is for general information and awareness only and does not constitute legal, financial, or cybersecurity advice. Information is drawn from publicly available sources including the Canadian Bankers Association and the City of Mississauga. Recovery of funds is not guaranteed. The Lady Tech is not affiliated with any company or organization mentioned and assumes no liability for outcomes resulting from the application of information in this article. Phone numbers were current as of December 9, 2026.