Fake QR codes and look-alike bill-pay sites
Check where a QR code or search result really goes before you pay. Type the company address yourself instead of trusting a paid search ad.
If this is happening to you right now
- Stop. Do not pay, click, or share any code or password.
- Hang up or stop replying.
- Tell someone you trust. Scammers want it kept secret.
- Look up the real number yourself before calling anyone back.
How this scam works
- QR codes: the FTC says people have reported scammers covering up real QR codes on parking meters with a code of their own. Scanning it can take you to a fake site designed to steal your money, your personal information, or both (FTC, Sep 3, 2026).
- Bill pay: the FTC says dishonest companies sometimes use paid search ads to trick you into paying them instead of the company or agency you were looking for. The top search result can be a paid ad that leads to a different company's site, and that site may add fees you did not expect (FTC, Aug 17, 2026).
- In the example the FTC shows, the top result looked like it belonged to a well-known lab company but was a paid text ad that went to another company's site. The FTC took this example from a complaint it filed in a legal case, and the page describes what the FTC alleges.
Warning signs
- A QR code that looks stuck on top of another sign or sticker.
- A QR link preview with spelling mistakes or switched letters.
- The top result when you search for a company's payment page is a paid ad.
- A payment site that is not the one printed on your bill.
- A fee at checkout you were not expecting.
What to do
- Before you go to a QR code link, check the web address your phone previews. Look for spelling mistakes or switched letters (FTC).
- Update your phone's operating system and apps, use strong passwords, and turn on multi-factor authentication for your accounts (FTC).
- To pay a bill online, scroll past paid search results to help make sure you have the right website (FTC).
- If you know the company's website address, type it directly into your browser to find the right payment site (FTC).
- If you think you scanned a bad QR code or paid through a look-alike site: do not contact the scammer, change any password you entered, review your credit card and bank statements, and report it (FTC).
- Paid by card or bank? See what to do after you paid.
Where to report it
- FTC: ReportFraud.ftc.gov
- Your state attorney general or consumer office: State directory
More: full reporting directory · what to do after you paid · family safety plan
Common questions
What should I do if I scanned a bad QR code?
The FTC says do not interact with the scammer. If you entered a username or password, change it right away, and change it anywhere else you use the same password. Check your credit card and bank statements for charges you did not make. Then report it at ReportFraud.ftc.gov.
How can I be sure I am on the real bill-pay page?
The FTC says scroll past paid search results, and type the company's website address directly into your browser if you know it.
Sources
Last verified: October 18, 2026. We link to the original public pages. Agency advice can change; check the linked page.
- See a QR code parked somewhere? Don't scan it…yet! (FTC Consumer Alert; Sep 3, 2026)
- Searching online: bill pay impersonators (FTC Consumer Alert; Aug 17, 2026)