# QR Code Scams at Hospitals and Healthcare Facilities > Fake Wi-Fi QR codes in waiting rooms, counterfeit medical-bill payment codes, and fraudulent patient-portal QR codes are targeting patients at their most vulnerable. Learn how to spot them and what to do if you already scanned one. URL: https://www.qrsafer.com/blog/hospital-qr-code-scams Published: 2026-04-19 --- A hospital waiting room is one of the few places where your guard is completely down. You're worried about a test result, managing a sick child, or navigating discharge paperwork — not thinking about cybersecurity. Scammers know this, and they've positioned healthcare facilities as a high-value target for QR code fraud. The exposure is also higher than most people realize. Healthcare data is worth more on the black market than credit card numbers alone, because it can be used to file fraudulent insurance claims, obtain prescription medications, or commit medical identity theft that takes years to unwind. ## Three Variants Targeting Healthcare Settings ### 1. Tampered Wi-Fi QR codes in waiting rooms Many hospitals and clinics post a QR code near the entrance or in the waiting area to help patients connect to free guest Wi-Fi. Attackers have begun placing sticker QR codes over these posted codes, redirecting patients to a fake network that looks like hospital Wi-Fi but is controlled by the attacker. Once you connect to a rogue network, the attacker can intercept unencrypted traffic — login credentials, insurance portal sessions, anything transmitted over an HTTP connection. The Wi-Fi name may match the real one exactly, making it nearly impossible to detect without checking the router. Before connecting to any healthcare facility's Wi-Fi via QR code, ask staff for the network name and password directly. If the code is on a sticker that feels layered or doesn't match the surrounding signage material, report it to the front desk. ### 2. Fake medical-bill payment QR codes This variant arrives in your mailbox. Attackers create counterfeit billing statements that mimic the design of real hospital or medical group invoices — same logo, same layout, same language — but with a QR code that redirects to a cloned payment page. The fake page may accept your credit card details and even display a confirmation screen, so you don't realize anything is wrong until the real bill arrives weeks later with an overdue balance. By then, your payment card and possibly your insurance information have been harvested. The key test: the URL behind the QR code on a real hospital bill will match the hospital's own domain. A cloned page typically lives on a recently registered domain with a name designed to look plausible — something like "regional-medical-pay.com" instead of "payment.regionalmédical.org." If in doubt, call the billing number printed on the statement using a number you looked up independently, not one on the suspicious bill itself. ### 3. Fraudulent patient-portal login QR codes The third variant appears on posters inside facilities — sometimes in exam rooms, corridors, or discharge areas. A printed sign encourages patients to "scan to access your health records" or "register for the patient portal." The QR code leads to a credential-harvesting page that looks like the real portal login. Entering your username and password on this page hands your account directly to the attacker, who can then access your medical records, view prescription history, and in some systems submit requests that trigger internal processes. Legitimate patient-portal QR codes should be verified with a staff member before use. If you didn't receive the code directly from a clinician or in an official letter, treat it with suspicion. ## The Special Risk of Healthcare Data Exposure Unlike a compromised credit card — which can be cancelled in minutes — compromised health data creates layered problems: - **Insurance fraud**: Attackers can file claims for services you never received, exhausting your coverage and damaging your claims record. - **Medical identity theft**: Fraudulent treatment records can corrupt your actual medical history, creating dangerous inaccuracies that affect future care. - **Prescription fraud**: Stolen patient credentials have been used to obtain controlled medications in the victim's name. These harms can persist for years. The extra step of verifying a QR code before scanning in a healthcare setting is worth considerably more than the few seconds it takes. ## What to Do If You Scanned a Suspicious Healthcare QR Code 1. **Do not re-enter any information** on the page if you haven't already. 2. **Change your patient portal password** immediately from a trusted device, using the hospital's official website found through a search engine. 3. **Call your health insurer** and ask them to flag your account for unusual claims activity. 4. **Alert the facility**: Report the suspicious QR code to the front desk or hospital security so they can remove it and warn other patients. 5. **Monitor your Explanation of Benefits (EOB) statements** for claims you don't recognize. 6. **File a report** with the FTC at [ReportFraud.ftc.gov](https://reportfraud.ftc.gov). For payment data specifically, the steps in our [QR code credit card scam guide](/blog/qr-code-credit-card-scam) apply directly. If the scam involved credentials for an account linked to banking, see our [bank QR code scam guide](/bank-qr-code-scam) for additional steps. ## One Rule That Covers All Three Variants In any healthcare setting, treat an unexpected QR code the way you'd treat an unexpected caller claiming to be your insurance company: verify through a channel you control before you give anything. Ask a staff member. Type the URL manually. Call billing from a number on the facility's official website. The QR code is always optional — the information is available another way. ## See also - [What to Do If You Scanned a Suspicious QR Code](/blog/what-to-do-if-you-scanned-a-suspicious-qr-code) - [Pharmacy QR Code Scams](/blog/pharmacy-qr-code-scams) - [Vet Clinic QR Code Scams](/blog/vet-clinic-qr-code-scams) - [Medicare QR Code Scam](/medicare-qr-code-scam) - [QR Code Threat Map](/threat-map) Download QRsafer for [iOS](https://apps.apple.com/app/qrsafer/id6743708403) or [Android](https://play.google.com/store/apps/details?id=com.bedrockdigitalsolutions20.qrsafer) to preview where any QR code leads before your browser opens it — especially in high-stakes environments like hospitals, clinics, and billing offices.