# QR Code Scams at Urgent Care and Walk-In Clinics > Fake check-in kiosks, fraudulent copay QR codes, and phishing texts disguised as appointment reminders are targeting patients at urgent care and walk-in clinics. Learn what each scam looks like and what to do if you already scanned one. URL: https://www.qrsafer.com/blog/urgent-care-qr-code-scams Published: 2026-06-23 --- Walk-in urgent care clinics are built for speed. You arrive without an appointment, check in, get treated, pay, and leave — all in under two hours on a good day. That fast, frictionless flow depends heavily on QR codes: digital check-in screens, insurance capture kiosks, copay terminals, and post-visit follow-up texts all use them. Scammers have noticed. Urgent care clinics combine the high patient traffic and minimal IT oversight of a restaurant with the sensitive data richness of a hospital. The result is a growing category of QR code fraud that most patients aren't thinking about while they wait with a fever or a sprained ankle. ## Four Scam Variants at Urgent Care Clinics ### 1. Fake check-in kiosk QR codes Many urgent care clinics use self-service kiosks near the front door to collect patient names, insurance cards, and date of birth before a visit begins. These kiosks display QR codes for patients to complete check-in on their own phone. Scammers target these kiosks with adhesive label swaps — placing a printed QR code sticker directly over the real kiosk code. The fake code opens a page that looks like the clinic's check-in form or patient portal login, but is a phishing site collecting your insurance ID number, date of birth, and sometimes your Social Security number. The attack is effective because patients expect to enter this information at check-in and don't question a form that looks identical to the legitimate one. In a high-turnover clinic where kiosks aren't wiped down between patients, a tampered label can stay active for an entire day. ### 2. Payment QR codes at the front desk or in mailed bills Urgent care clinics routinely mail statements after a visit with a QR code to pay online. Attackers intercept this expectation with counterfeit billing notices — same clinic logo, same layout, real-looking balance — but with a QR code that points to a fake payment portal. The fake portal accepts your card number and shows a confirmation screen, so you don't realize anything is wrong until the real bill arrives with an overdue balance weeks later. Your payment card and insurance details have already been harvested. In-clinic payment terminals can also be compromised. An unattended counter with a QR code for "scan to pay" is an easy target for a sticker swap. ### 3. Pre-visit "verify your insurance" phishing texts This variant arrives by text message, timed to reach patients within minutes of an appointment reminder. The message appears to come from the clinic and includes a QR code asking patients to "verify your insurance before your visit to reduce wait time." The urgency is built in — nobody wants to spend extra time at the front desk when they're already feeling sick. The QR code opens a page that mimics the clinic's portal or insurance verification screen, collecting your insurance member ID, group number, date of birth, and sometimes a credit card for the expected copay. Real clinics collect insurance information in person at check-in or through their established intake platforms. A pre-visit insurance verification text asking you to click or scan an external link is a red flag. ### 4. Post-visit "rate your experience" or "view your summary" texts After discharge, urgent care clinics often send a follow-up text with a link to a satisfaction survey or visit summary. Scammers replicate this flow with fake texts containing a QR code that redirects to a credential-harvesting page disguised as the clinic's patient portal. Patients who scan assuming it's the clinic's routine follow-up will be presented with a login page. Entering credentials there gives the attacker access to your actual patient portal, where they can view medical records, prescription history, and stored payment methods. ## Why Urgent Care Is a Particularly High-Risk Environment Several factors make urgent care clinics attractive to scammers: - **High turnover**: Dozens of patients cycle through each day. Tampered kiosk stickers and waiting-room signs are rarely inspected between visits. - **Minimal IT oversight**: Independent and franchise urgent care locations often don't have dedicated IT staff monitoring physical security. - **Patient distraction**: People visiting urgent care are sick, in pain, or managing an anxious child. Scrutinizing a QR code URL is not top of mind. - **Seasonal spikes**: Urgent care traffic surges in winter during flu and RSV season, and in summer during sports injuries and camp health requirements. Scammers time their placements to coincide with these peaks. ## How to Tell a Real Urgent Care QR Code from a Fake The key is the destination URL. Before entering any information, preview where the QR code leads: - A real check-in or patient portal code should resolve to the clinic's own domain (for example, **citymd.net**, **afcurgentcare.com**, or a platform like **solvhealth.com**, **phreesia.com**, or **klara.com**). - A real payment QR code will lead to the clinic's billing portal on their official domain, not a generic payment site you've never seen. - A real post-visit follow-up text will come from a number your phone has seen before, or the message will be embedded in your existing conversation history with the clinic. If the URL looks unfamiliar, the page asks for more than the situation warrants, or the form loads before any app recognizes the clinic's branding, stop and ask the front desk to show you the correct way to complete check-in or payment. ## What to Do If You Scanned a Suspicious Urgent Care QR Code 1. **Don't re-enter anything** on the page if you haven't already. 2. **Call your health insurer** and ask them to flag your account for suspicious claims activity. 3. **Change your patient portal password** from the clinic's official website found through a search engine — not a link from the suspicious message. 4. **Alert the clinic**: Tell the front desk or call the main number so they can check their kiosk and signage for tampering. 5. **Dispute any card charges** with your issuer if you entered payment details. 6. **File a report** with the FTC at [ReportFraud.ftc.gov](https://reportfraud.ftc.gov). ## See also - [QR Code Scams at Hospitals and Healthcare Facilities](/blog/hospital-qr-code-scams) - [Pharmacy QR Code Scams](/blog/pharmacy-qr-code-scams) - [Dentist QR Code Scam](/dentist-qr-code-scam) - [What to Do If You Scanned a Suspicious QR Code](/blog/what-to-do-if-you-scanned-a-suspicious-qr-code) - [How to Check If a QR Code Is Safe](/how-to-check-if-a-qr-code-is-safe) Download QRsafer for [iOS](https://apps.apple.com/app/qrsafer/id6743708403) or [Android](https://play.google.com/store/apps/details?id=com.bedrockdigitalsolutions20.qrsafer) to preview the destination URL of any QR code before your browser opens it — including at check-in kiosks, payment terminals, and in texts from healthcare providers.