QR Code Scams on SMS / Text
Scam texts contain QR codes or links to coded images that lead to phishing pages or malware, hiding the destination and exploiting quick scanning habits.
Part of: QR-Code Scams (Quishing)
Last reviewed: 1 June 2026
A scam text may carry a QR code image or a link to one, framed as a parcel redelivery, a payment confirmation, or an account alert. The code conceals its destination, and because you scan it on the same phone, there is no second device to add friction or scrutiny.
SMS is a neutral channel; the harm comes from the hidden destination the code opens. Scammers use coded images in texts because they sidestep the wariness people have learned to apply to suspicious links while keeping the malicious target out of sight.
How this scam works on SMS / text
The text asks you to scan a QR code to reschedule a delivery, confirm a payment, verify an account, or claim a refund. The code is presented as the quick, official way to resolve the matter.
Scanning opens a phishing page that mimics a courier, bank, or account login, capturing your card or credential details, or it triggers a malicious download. The action stays on your phone, with no chance to inspect the link first.
The everyday pretext and the convenience of an instant scan are built to bypass the caution a visible, suspicious link would trigger.
Common red flags
- A text asks you to scan a QR code for a delivery, payment, or account issue
- The code's destination is hidden behind the image
- Scanning opens a courier, bank, or login page requesting your details
- You are urged to scan quickly to avoid a fee, loss, or missed delivery
- The sender is unknown or the number looks unusual
- The page asks for card details or a login after scanning
How to protect yourself
- Do not scan QR codes sent in unexpected texts
- Reach couriers, banks, or accounts by typing their official address yourself
- Preview a code's URL before opening it if your scanner allows
- Never enter card or login details on a page reached from a scanned code
- Delete the text and block the sender
- Verify any delivery or payment directly through the official app or site
How to report it
- Forward the text to your national smishing or spam reporting number where available
- Report the impersonation to the organisation being spoofed via its official site
- File a report with your local fraud or cybercrime reporting service
Frequently asked questions
Why is scanning a QR code from a text risky?
The code hides its destination, so you cannot check the link first, and the action stays on your phone with no extra scrutiny. Avoid scanning codes from unexpected texts and reach services by typing their official address.