An official warning, not a rumor
FBI — Internet Crime Complaint Center (IC3), alert PSA250731
Published on July 31, 2025, this alert describes a specific scheme: unsolicited packages delivered to individuals, containing a note with a QR code inviting them to scan it "for more information" — a way to kick off fraud schemes through an unexpected physical intermediary.
FTC (Federal Trade Commission) — consumer alerts
The FTC has published three separate alerts on this topic: in December 2023, on scammers hiding malicious links in QR codes; in January 2025, a specific alert about QR codes arriving with unexpected packages, redirecting to phishing sites designed to steal credentials or card numbers; in April 2026, a new alert about texts imitating a traffic violation notice, with a QR code to scan to pay a fake fine or fictitious hearing.
The toll and parking variant: the link hidden inside an image
The text looks like an official notice — a state seal, a case number — and offers two choices: show up for a scheduled "hearing," or pay the fine by scanning the QR code. What the FTC's April 2026 alert specifically documents: the technique also serves to bypass spam filters, which catch a link written as text but not one hidden inside an image. Scanning the code leads to a payment page that captures banking details, even before considering the risk of malware installed along the way.
Source: FTC Consumer Advice — "That text about a traffic violation is probably a scam," April 2026.
Why this vector works
A regular link in an email can be hovered over to check the address before clicking. A QR code can't — you have to scan it to find out where it leads, and the phone's camera hides the verification step that many people have learned to apply to text links. That's exactly why the FTC and FBI specifically target this vector in their recent alerts — packages, parking meters, posters in public spaces: the physical medium lends a legitimacy the link alone wouldn't have.
Frequently asked questions
What is quishing?
A blend of "QR code" and "phishing": a scam where a fake QR code, often stuck onto a real object (a package, a parking meter, a poster), redirects the victim to a fraudulent site instead of the legitimate one.
Has the FBI really warned about this?
Yes. The FBI's complaint center (IC3) published a specific alert on July 31, 2025, about unsolicited packages containing QR codes used to launch fraud schemes.
How can you spot a fake QR code?
Be systematically wary of any QR code received by mail, stuck on an existing surface, or paired with a message creating urgency. The safest move: never scan an unexpected QR code, and check the displayed address before continuing if you scan it anyway.
Does the QR code trick also show up in fake toll or fine texts?
Yes. In April 2026 the FTC published an alert about texts imitating a traffic violation notice, with a QR code to scan to pay a fake fine or fictitious hearing — a variant that hides the fraudulent link inside an image rather than in text, specifically to bypass spam filters that catch written links.
Other markets we cover
Quishing isn't a US-only pattern — the same fake sticker over a real QR code has shown up on parking meters and delivery notices from Australia to Canada.
🇦🇺Australia — QR scams targeting myGov, Medicare and Australia Post
Scamwatch (the ACCC's reporting service) has logged more than 28 QR-code scams since 2020, with losses exceeding AU$100,000, alongside fake stickers reported over legitimate codes on parking meters and café tables in Victoria. Separately, Services Australia and the ATO have both warned that scam QR codes are being sent by email or text impersonating myGov, Medicare and tax refunds.
Scamwatch (ACCC), cited by CyberSecRad, July 31, 2025; CHOICE.🇬🇧United Kingdom — nearly 800 reports and £3.5 million lost in a year
Action Fraud received close to 800 reports of QR-code fraud in the twelve months to April 2025, totaling £3.5 million in losses — most of it stickers placed over legitimate codes on car-park payment machines. One London borough, Kensington and Chelsea, found fake QR codes at six different locations in a single month in 2025.
The Bureau of Investigative Journalism; Which?, 2025.🇨🇦Canada — fake parking QR codes from Montreal to Kelowna
Police and municipal warnings tracked the same sticker scam moving city to city: Ottawa removed fake QR-code stickers from 51 parking machines after a report on November 3, Kelowna RCMP investigated 75 fraudulent codes found on parking meters, and Toronto police opened a Financial Crimes Unit investigation in April 2026 after fake codes turned up on meters across the city.
City of Ottawa; Global News (Kelowna); CP24 (Toronto), April 2026.🇮🇳India — AI-tampered QR codes diverting digital payments
In December 2025, Delhi Police arrested a man from Rajasthan for using AI tools to tamper with a merchant's QR code, diverting ₹1.40 lakh from a customer's payment before it reached the shopkeeper. In June 2026, police in Varanasi arrested three people running a wider network that used fake merchant QR codes to launder proceeds linked to 178 fraud complaints worth roughly ₹114.32 crore.
ANI News, December 23, 2025; The420.in, June 2026.Go further
Egidio — The Threat Laboratory, "Fake QR codes & quishing: the scam that starts with a scan", egidio.app/en/laboratoire/fake-qr-codes-quishing/. Licensed CC BY 4.0.
Free to reuse, including commercially, with attribution. Reuse terms.