Fake QR code scam : fonctionnement, signaux et que faire

Payment fraud · médio

The scammer sticks a fake QR code over the real one on counters, menus, parking meters or posters, or sends a QR code by email or letter as a "bill" or "account update".

Scanning it leads to a Pix payment to the scammer's account or to a fake bank, service or parking site asking for login and card details.

Because a QR code hides the address, it's harder to spot that the destination is fake — which is also why the trick is used to bypass email filters.

Sinais / Signs

QR sticker placed over another or with loose edges.
Pix payee name differs from the business.
QR code in an email asking for login or urgent update.
Site opened by the QR code has an odd address.
Card details requested for parking or a simple service.

Prevenção / Prevention

Before confirming a QR Pix, check the payee name and company ID.
Prefer typing the site address or using the official app over scanning public QR codes.
Distrust QR codes in emails or letters asking you to log in.
Merchants: regularly check that your QR codes haven't been covered.
Use your banking app's scanner, which shows the payee before paying.

O que fazer / What to do

Call your bank right away using the official number (back of the card or in the app) and ask to block cards, accounts and access.
If you paid via Pix, ask your bank to open a MED (Special Return Mechanism) claim as soon as possible — time matters because funds move fast.
Change passwords for email, banking and social media, turn on two-step verification and sign out of other devices.
Tell the business so it can remove the fake QR code.
File a police report (many Brazilian states accept online reports) and keep screenshots, receipts, numbers and links.

FAQ

How can I tell if a Pix QR code is genuine?

Your banking app shows the payee name before confirmation. If it isn't the business, cancel.

Are QR code scams growing?

APWG's annual review highlights the spread of scams via social media, SMS, email and QR codes (source: APWG Year in Review).

APWG Year in Review — scams via social media, SMS, email and QR · CERT.br — Cartilha de Segurança para Internet · FTC — ReportFraud