QR Code Scams on Gumtree
Gumtree buyers and sellers are targeted with QR codes in messages and listing images that redirect to phishing sites or initiate unauthorised payments when scanned.
Part of: QR-Code Scams (Quishing)
Last reviewed: 1 June 2026
QR code fraud on Gumtree is used by both fraudulent buyers and sellers. A fraudulent buyer sends a QR code to a seller claiming it represents a payment confirmation or bank transfer reference, when scanning it actually initiates a payment away from the seller's account. A fraudulent seller includes a QR code in listing images claiming it leads to additional product information, when it actually leads to a credential-harvesting page.
The Gumtree audience includes many users who are less technically experienced with QR fraud, making the format effective in peer-to-peer commerce contexts.
How this scam works on Gumtree
A fraudulent buyer contacts a seller and says they have made payment — including a QR code as 'proof'. The seller scans the code, which opens a page requesting their bank login to 'verify receipt' of the funds, or triggers an outgoing payment from a mobile banking app.
A fraudulent seller includes a QR code in their listing under the guise of 'scan for more photos' or 'scan for full specifications'. The code opens a phishing site styled as a product page, requesting the buyer's card details to 'reserve' the item.
Some variants involve QR codes in arranged-meetup communications — a buyer sends a 'digital receipt' QR code after meeting in person, which leads to a phishing page when scanned later.
Common red flags
- Gumtree message from a buyer including a QR code as payment proof or confirmation
- Listing image containing a QR code with a vague 'scan for more details' prompt
- Post-meetup digital receipt sent as a QR code
- QR code destination URL that differs from the expected bank or platform domain
- Any request to scan a QR code as part of a Gumtree transaction
How to protect yourself
- Never accept QR codes as proof of payment — verify funds in your account directly through your banking app
- Do not scan QR codes in Gumtree listing images or messages from unknown parties
- Check the URL decoded from any QR code before visiting the page
- Report any Gumtree listing or message containing a QR code used for payment or verification
- Use only traceable payment methods and verify receipt of funds before releasing goods
How to report it
- Report the Gumtree listing or message using the 'Report this ad' or user report function
- Report the phishing URL to your national cybercrime authority
- Contact your bank immediately if your account was accessed via a QR-linked page
Frequently asked questions
Can a QR code cause an outgoing payment from my bank account?
If the QR code opens a page that mimics your mobile banking login and you enter your credentials, the fraudster can then initiate payments from your account. Some mobile payment apps also use QR codes to initiate payments — never scan a QR code in a commerce context without checking the decoded URL first.