Agent Lane robot mascotAgent Lane
Menu

Guide

QR code scams and crypto: what to check before you scan

Short answer: Don’t scan a QR code from a text or email you weren’t expecting, and never scan one someone sends you to “pay” or “protect” your money in crypto. If you do scan one, read the web address your phone shows before you open it, and never log in or connect a wallet from a code you didn’t expect.

By Agent Lane Editorial · Page dated 3 November 2026

How do scammers use QR codes?

The FTC says scammers hide harmful links in QR codes. They send a code by text or email with a made-up reason to scan it, such as a missed delivery, a problem with your account or suspicious activity that needs a password change, and some have stuck their own codes over real ones on parking meters. The code can open a fake site that looks real and steals what you type, or install malware.

How do QR codes come into crypto scams?

  • To pay the scammer. The FTC says scammers who send people to crypto ATMs give them a QR code to scan, which sends the payment straight to the scammer’s wallet. See Bitcoin ATM scams.
  • To steal your login. A code that opens a fake exchange or wallet login page. See how to check a crypto website is real.
  • To connect your wallet. A code that opens a site asking you to connect your wallet and approve something. That approval can empty it. See crypto wallet drainers.

What should I check before I scan?

  1. Was it expected? The FTC says not to scan a QR code in an email or text you weren’t expecting, especially one that urges you to act now.
  2. Does it look tampered with? A sticker over another code on a meter or sign is a warning.
  3. Read the web address your phone shows before you open it. The FTC says to check it’s one you recognize, with no misspellings or switched letters.
  4. If the message might be real, skip the code: go to the company’s website or call a number you know is real.
  5. Never send crypto to a code someone else gave you to pay a bill, a fine or a “safe account.” Only scammers ask for that.

What about QR codes for my own wallet address?

Those are normal: wallets show a QR code so someone can send crypto to you. The risk runs the other way, when someone gives you a code to send crypto to them. If you’re paying someone you know, check the address your wallet shows against one they confirm another way before you send. Not sure? Run it through the 10-question crypto scam checklist.

What if I already scanned one?

  • If you typed a password, change it on the real site now and turn on two-factor login. See how to lock down your exchange account.
  • If you connected a wallet or approved something, move what’s left to a new wallet you control and follow the steps in crypto wallet drainers.
  • If you sent crypto, contact the exchange or ATM operator you used right away and report it at ReportFraud.ftc.gov and ic3.gov.
  • Update your phone’s software, as the FTC advises.

Sources

Checked 3 November 2026 on each organization’s own site.

Related guides

All guides