You drop off your car, hand over the keys, and wait. The service advisor hands you a paper invoice or points you to a payment kiosk. There's a QR code. It takes ten seconds to scan and pay — maybe the fastest part of your day.
That convenience is exactly what scammers count on.
Auto repair and service centers combine everything that makes QR code scams effective: high stress, unfamiliar pricing, time pressure, and a routine that has trained people to scan and pay without scrutinizing where the payment goes. Here are the four variants to watch for.
Variant 1: Fraudulent mechanics at parking lots and mobile solicitors
Not every attack happens inside a shop. Scammers posing as mobile mechanics, windshield repair specialists, or roadside service providers approach drivers — often in parking lots near auto parts stores, car washes, or large retailers — offering quick fixes and presenting a QR code on a tablet or printed card to "pay for the estimate" or "lock in the price."
The QR leads to a payment page designed to look like Venmo, Zelle, or a generic payment portal. The scammer collects the payment and disappears. In some cases, the page harvests card details rather than processing a payment at all.
The tell: Legitimate mobile mechanics do not require prepayment via QR code before performing any work. Never pay a solicitor via a QR code they hand you directly.
Variant 2: Sticker QR codes over payment kiosks at service counters
Many independent shops and national service chains (oil changes, tire shops, alignment centers) use self-service payment kiosks or countertop QR codes that let customers pay without waiting for a cashier. These codes are easy targets for sticker swaps.
A scammer places a printed QR sticker over the real payment code. The new code leads to a fake payment portal — often a convincing copy of the real chain's checkout page — that collects card details and either returns a fake confirmation or times out. Victims often don't notice until they check their bank statement and see no corresponding charge to the shop.
The tell: After scanning, check that the domain in your browser's address bar matches the shop's official website. If you see an unfamiliar domain or a generic payment processor you don't recognize, close the browser and pay at the front desk.
Variant 3: "Leave us a review" QR codes that harvest credentials
Mechanics and service shops routinely print QR codes on receipts or display them on countertop cards to collect Google or Yelp reviews. This is a legitimate and common practice — which is why scammers replicate it.
A sticker placed over the real review QR code redirects customers to a fake Google or Yelp sign-in page. Victims enter their credentials, which are harvested immediately. The attacker now has access to the Google account — including Gmail, Drive, and any services linked to that login.
The tell: A legitimate Google review link takes you directly to the business's Google Maps listing without asking you to log in first. If a "review" page asks for your Google password immediately, leave the page.
Variant 4: Fake extended-warranty QR codes by mail and text
This variant doesn't happen at the shop — it comes to you. Scammers send mailers, texts, and emails impersonating vehicle manufacturers, dealerships, or third-party warranty companies. The message claims your factory warranty or extended coverage is expiring and includes a QR code to "renew coverage now" or "verify your vehicle's protection status."
The linked page asks for your VIN, mileage, name, address, payment method, and sometimes financial details. In the worst cases the "application" also requests your Social Security number under the guise of a credit check.
Scammers using this approach often know your vehicle details — year, make, model — because the information is in public records from vehicle registration databases sold to marketing lists. That knowledge makes the mailer feel more credible.
The tell: Your car's actual warranty information is in your owner's manual and on file with the manufacturer — call them directly if you have questions about coverage. No legitimate warranty company requires you to pay or provide personal details via a QR code from an unsolicited message.
What to do if you've already scanned and paid
- Call your card issuer immediately. Report the transaction as fraudulent. Most card issuers will freeze the card, open an investigation, and issue a replacement.
- Request a chargeback. If card details were harvested and used for subsequent charges, dispute each one with your bank.
- Change any compromised passwords. If you entered credentials, reset those passwords on the official site immediately and enable two-factor authentication.
- File a report. Submit a complaint to the FTC at reportfraud.ftc.gov and, for significant losses, to the FBI's Internet Crime Complaint Center at ic3.gov.
Quick reference
- Any QR code at an unattended payment station is a potential sticker-swap target — check the URL before tapping.
- "Leave us a review" codes should lead to your business's Google Maps listing without a sign-in prompt.
- Warranty renewal QR codes from unsolicited mail or texts are almost always scams — verify directly with the manufacturer.
- Parking-lot solicitors who accept payment only by QR code are a red flag.
See also
- QR Code Scams at Car Dealerships
- Gas Station QR Code Scams
- Fake Invoice QR Code Scam
- How to Spot a Malicious QR Code Before You Scan
- QR Code Threat Map
Download QRsafer for iOS or Android and scan any shop's QR code before your browser opens it — especially at unattended kiosks where a sticker swap takes seconds to set up.