QR Code Phishing Scams: How Fake QR Codes Steal Crypto
July 14, 20263 min read
Key Takeaways
Scammers swap legitimate QR codes for their own, so the address your wallet shows after scanning can silently be the scammer's.
Always verify the destination address on your phone screen before sending — check the first and last characters, not just the middle.
Look for physical tampering (a sticker placed over the original code) and prefer official payment pages where you type the URL yourself.
Send a small test amount first for large transactions, and never scan a QR code from an unfamiliar email, social post, or mailer.
QR codes are convenient for crypto payments but can be replaced with scammer addresses. Always verify before scanning.
How QR Code Scams Work
Stage
What Happens
1
Scammer replaces a legitimate QR code with their own
2
Victim scans the code expecting to pay a business
3
The QR code contains the scammer’s wallet address
4
Victim sends crypto to the scammer
5
Funds are gone — irreversible
Where Fake QR Codes Appear
Location
How It’s Replaced
Café or shop
Legitimate QR sticker covered by fake
Gas station
Payment QR replaced
ATM or kiosk
QR code on machine replaced
Conference or event
Sponsor QR replaced
Email invoice
QR image in email is fake
Social media post
Fake donation QR
Physical mail
Letter with fake QR code
The “Invoice” QR Scam
Element
Scam
Email
Looks like a legitimate invoice
QR code
Links to scammer’s payment page
Urgency
”Pay within 24 hours or service cut off”
Amount
Looks reasonable
Destination
Scammer’s wallet
Crypto ATM QR Scams
Step
What Happens
1
You go to a Bitcoin ATM
2
The machine displays a QR code for your wallet
3
Scammer has tampered with the machine
4
You scan the QR — it’s actually the scammer’s address
5
Your cash goes to the scammer
How to Protect Yourself
Rule
Why
Verify the QR destination before sending
Check the address on your phone
Cover existing QR codes with your hand
Prevents camera from reading a swapped code
Use official payment pages
Type the URL manually, don’t scan
Check for tampering
See if a sticker is placed over the original
Send a test amount first
Small test to confirm destination
Use NFC instead of QR
Less common for tampering
Verifying a QR Code
Step
Action
1
Scan the QR code
2
Check the wallet address on your phone screen
3
Confirm the first and last 6 characters match the expected address
4
Verify on the business’s official website
5
Only send after confirmation
What to Do If You Scan a Fake QR
Step
Action
1
Don’t send the transaction
2
Leave the location immediately
3
Report to the business owner
4
Warn others on social media
5
Report to Action Fraud if funds were lost
Bottom Line
QR code scams replace legitimate payment codes with scammer addresses. Verify the destination address on your phone before sending any crypto. Check for tampering (stickers placed over original codes). Send a test transaction for large amounts. Use official payment pages and apps rather than scanning unknown QR codes. A moment of verification saves irreversible loss.
Why a sticker is all it takes
The QR scam is disarmingly low-tech at its core. People assume a QR code must be trustworthy because it takes effort to produce, but creating a code is trivial, and printing a label-sized sticker costs nothing. A scammer only needs a moment alone with a café’s payment point, a gas pump, or a machine’s display to place their own code over the original. Because the human eye cannot read a QR code, the visual deception is perfect — the only way the trick fails is if the payer actually looks at the wallet address that appears on their own phone before approving. That single habit, repeated every time, is the entire defence.
Building verification into your routine
Rather than treating each payment as a one-off decision, make verification a default step every time you pay with crypto. Cover the code with your hand before scanning so your camera cannot accidentally read a swapped sticker. Prefer official payment apps and pages where you type the URL yourself instead of scanning an unknown code. When you do scan, glance at the address on your screen and match at least the first and last six characters, and for anything significant cross-check that address on the business’s official website. For larger amounts send a test transaction first. These small, repeatable rules cost a few seconds but turn an irreversible payment into a checked one.
If it goes wrong
The worst outcome — discovering after the fact that you paid a scammer — is also the simplest to keep from compounding. Do not confirm a transaction you suspect, even under pressure. Leave the physical location, tell the business owner so they can inspect and replace the tampered code, and warn others who may scan the same spot. If funds were already sent, note the address and transaction hash and report to Action Fraud or your local authority. The money is gone and cannot be recovered, but the report matters for the record.
Bottom line
QR code scams replace legitimate payment codes with scammer addresses. Verify the destination address on your phone before sending any crypto. Check for tampering — stickers placed over original codes — and use official payment pages and apps rather than scanning unknown QR codes. Send a test transaction for large amounts. A moment of verification saves irreversible loss.
Frequently Asked Questions
How does a fake QR code steal my crypto?
A scanner simply reads whatever address is encoded in the code it photographs. If a scammer covers a legitimate payment QR with their own, your wallet fills in the attacker's address and you approve the payment without noticing. A moment of checking the on-screen address prevents this.
Where are fake QR codes most commonly found?
Anywhere a real code lives and can be physically covered or digitally replaced: stickers on café and shop payment points, gas station and ATM machines, event sponsor codes, and screenshot-ready QR images inside email invoices or social posts.
What should I check before sending crypto after scanning a QR?
Confirm the wallet address your phone displays, matching at least the first and last six characters against the address you expect, and verify that same address on the business's official website. For large amounts, send a test amount first and confirm it arrives before sending the rest.
I think I scanned a fake QR — what now?
Do not confirm the transaction. Leave the location immediately, tell the business owner so they can check and replace the code, and warn others. If funds were already lost, note the address and report it to Action Fraud (UK) or your local authority with the transaction hash.
PP
PaisayehPaisa Editorial Team
Financial education in plain language. Our team reviews every article for accuracy and clarity.