You pull into a parking lot in a new city, see a sticker on the meter that says scan to pay, point your phone at it, and enter your card number on the page that loads. It feels routine, because half of travel runs on QR codes now. But that sticker may not belong to the parking company. It may be a counterfeit pasted over the real one by a scammer, and the page you just typed your card into may exist only to steal it.
Federal authorities have spent the 2026 summer travel season warning about exactly this. The FBI and the Federal Trade Commission have both flagged a sharp rise in travel related fraud, and one of the fastest growing tricks has a name: quishing, short for QR code phishing. It is effective because it turns a habit travelers already have into the attack itself.
- The trick: Scammers cover real QR codes with fake stickers that lead to lookalike payment or login pages
- Where it hits: Parking meters, restaurant menus, hotel flyers, e-bike and scooter docks, and fake booking emails
- The goal: To capture your card number or your account logins in a moment when you are rushed and distracted
- The defense: Check the web address after you scan, and never pay by gift card, crypto, or wire transfer
How a QR code scam works
The mechanics are simple, which is what makes quishing spread. A scammer prints a sticker with their own QR code and places it over a legitimate one in a public spot. When you scan it, your phone opens a website that is built to look like the real parking service, restaurant, or hotel portal. You enter a card number or a password, and it goes straight to the scammer instead of the business. Nothing on your phone looks broken, because the page is a convincing copy.
The same idea travels by message. The FTC has warned that fake booking confirmations and travel alerts are among the most common scams right now, often arriving as a text or email that copies the logos and wording of a real airline, hotel, or booking site. A link or a QR code in that message points to the same kind of fake page. The pressure is usually a small, urgent task, such as confirm your reservation or pay a balance, designed to make you act before you look closely.
Where travelers get hit
Quishing thrives in the exact moments travel makes you hurry. Knowing the common spots is half the defense, because a scan you expected is easier to second guess than one that catches you off guard.
- Parking meters and lots: A fake scan to pay sticker over the real one is the classic version of this scam.
- Restaurant and bar menus: A tampered table QR code can route a tip or a tab to a fake payment page.
- Hotel and rental flyers: Notices in lobbies or rooms that ask you to scan to check in or confirm a charge.
- Fake confirmation messages: Texts and emails that mimic a real booking and push you to a lookalike site.
The destinations hosting big crowds this year are prime targets, since scammers follow the foot traffic. Areas packed for major events draw both visitors and the people trying to cheat them, which is why our coverage of World Cup ticket scams and the FBI warning tracks the same playbook in a different setting. The tools change, but the goal of separating a distracted traveler from their money does not.
How to protect yourself
The single most useful habit is to read the web address after you scan and before you type anything. If the link looks off, has a strange domain, or does not match the business you are standing in front of, close it. For payments, type a known official address into your browser yourself rather than trusting a code, and skip sponsored search results, which scammers sometimes buy to place fake sites at the top. When you do pay, use a credit card, never a gift card, cryptocurrency, or a wire transfer, because a card gives you a path to dispute a fraudulent charge.
A few setup steps make travel safer before you leave. Turn on transaction alerts so a strange charge pings your phone immediately, and keep your apps and phone updated. Staying connected with your own data plan also helps, since you are less tempted to scan a random code for free access. Our comparison of travel eSIM versus roaming covers staying online safely abroad, and our travel gear hub rounds up the tools that keep your phone and accounts protected on the road.
- Tampered stickers: A QR code that looks pasted on, peeling, or slightly crooked over another one.
- The address bar: A domain that does not match the business, or a string of random characters.
- Urgent payment requests: Any message rushing you to confirm or pay through a scanned link.
- Odd payment methods: A request for gift cards, crypto, or wire transfer is a clear red flag.
QR codes are not the enemy, and you do not need to stop using them. The fix is a two second pause: glance at the address you landed on, make sure it matches where you are, and pay with a card that has your back if something goes wrong. That small habit is what turns a rushed traveler into a hard target.
What is a QR code travel scam?
It is a fraud where a scammer places a fake QR code, often a sticker over a real one, in a spot travelers use, such as a parking meter or a restaurant menu. Scanning it opens a lookalike website that steals your card number or account login. The tactic is called quishing, short for QR code phishing.
How can I tell if a QR code is fake?
Look for a sticker that seems pasted over another code or is peeling or crooked. After scanning, check the web address before entering anything. If the domain does not match the business or looks like random characters, close the page and do not enter your details.
What should I do if I scanned a scam QR code?
Do not enter any information, and close the page. If you already entered card details, contact your bank or card issuer right away to flag the charge, watch your account for unusual activity, and change any password you typed. Paying by credit card makes it easier to dispute a fraudulent charge.
How do I pay safely while traveling?
Type a business’s official web address into your browser yourself instead of trusting a scanned code, and avoid sponsored search results. Pay with a credit card rather than a gift card, cryptocurrency, or wire transfer, and turn on transaction alerts so you spot a bad charge fast.
