Your group has booked the session, signed the waiver at the lobby tablet, and the game master locks the door. You scan a QR code on the wall to start the first clue. Somewhere in that frictionless, scan-everything experience, a scammer may have inserted themselves — and you wouldn't have known until the charge hit your statement.
Escape rooms have become one of the most QR-code-dense entertainment venues in the country. Codes appear at the booking stage, at check-in, inside the room itself, and at tip payment after the game. That makes the escape room experience a four-stage target for QR fraud — one of the only entertainment formats where a single outing exposes visitors to every major variant of the scam.
Four QR Code Scam Vectors at Escape Rooms
1. Fake "book your session" QR codes on flyers at nearby venues
The escape room industry runs almost entirely on advance bookings and deposits. Scammers exploit that business model with physical flyers placed at nearby bars, bowling alleys, and movie theaters — venues where the target audience naturally overlaps.
The flyer mimics a local escape room brand: same name, similar logo, a compelling offer ("50% off your first session — scan to book!"). The QR code leads to a lookalike booking page that collects a deposit and a name, then generates a plausible-looking confirmation number. When the group shows up at the real venue on the day of their session, the booking doesn't exist — because it was never made through the real system.
Scam listings amplify this risk. Fake escape room businesses appear on Google Maps, Yelp, and Eventbrite with polished profiles, stock photos, and fabricated reviews. A search for "escape room near me" can surface one of these listings above the real venue. The booking page — reached via QR code or search — harvests the deposit and disappears.
Always book by navigating directly to a venue's official website, not by scanning a QR code on an unsolicited flyer or clicking through a search listing without verifying the address.
2. Tampered waiver-signing QR codes at reception
Most escape rooms require a liability waiver before you play. Signing it digitally via a tablet or a QR code posted at reception has become standard. That process is routine enough that most people don't examine the URL before typing their name.
A tampered waiver QR code — applied as a sticker over the venue's original code — redirects to a phishing page styled to look like a standard waiver form. A legitimate waiver asks for your name, date, and signature. A data-harvesting fake asks for date of birth, phone number, a "security deposit" card number, or — in more aggressive variants — a Social Security number for "identity verification." None of those fields belong in an entertainment liability waiver.
Before entering any personal information on a waiver page reached via QR code, confirm the URL in your browser matches the escape room's official domain. If a field requests payment details, a SSN, or anything beyond name and signature, tell staff immediately.
3. In-room prop QR codes replaced by a sticker
In-room QR codes are part of the designed puzzle experience. Venues control them and they link to game assets — videos, combination clues, audio files — that are hosted on the venue's own system. Under normal conditions, scanning them is completely safe.
The exception is physical access. A disgruntled employee, a former worker, or a vandal with after-hours access to the room can print a replacement sticker and press it over a prop code in seconds. The replacement links to an external site that could serve malware, harvest credentials, or redirect to a phishing page.
The tell is the content: a legitimate escape room puzzle QR code will not ask you to log in, create an account, enter payment details, or provide personal information as part of a clue. If an in-room code does any of those things, exit the puzzle and flag it to staff before continuing.
4. Tip QR codes for game masters vulnerable to sticker-swap
Tipping game masters has moved to peer-to-peer payment apps — a QR code for Venmo or Cash App on a table card or small sign in the lobby or debriefing area. These codes are a legitimate part of how game masters earn, and most are genuine.
They are also among the easiest targets for sticker-swap fraud. An attacker prints a Venmo or Cash App QR code linked to an account they control, cuts it to size, and presses it over the game master's real code. The swap requires no tools, takes under ten seconds, and can sit undetected for days. The game master's tips go to the attacker instead.
Before scanning a tip code, look for raised sticker edges, mismatched paper texture, or a code that doesn't quite align with the surrounding print. If anything looks off, ask the game master for their handle and search for it manually inside your payment app.
What Legitimate Escape Room Booking Looks Like
A real escape room booking process goes through the venue's official website or a recognized ticketing platform like Tickets.com or Eventbrite (with the listing traced back to the venue's verified account). Confirmations arrive from the venue's own domain. Deposits are processed through Stripe, Square, or a comparable payment gateway with a recognizable checkout flow — not a generic PayPal link or peer-to-peer app.
Legitimate waivers are hosted at the venue's domain, ask for name and signature only, and do not request payment or government ID. Official tip QR codes come from a game master who can confirm their own Venmo handle if you ask.
What to Do If You Were Caught
- Call your bank or card issuer immediately and report any unauthorized charge — request a chargeback and a new card number.
- Dispute peer-to-peer payments through Venmo or Cash App support as quickly as possible — recovery windows are narrow.
- Change your password on any account where you entered credentials on a suspicious page, and turn on two-factor authentication.
- Report to the FTC at ReportFraud.ftc.gov.
- Tell the escape room — staff can check for tampered stickers and warn other guests.
For more on what to do after a suspicious scan, see our guide: What to Do If You Scanned a Suspicious QR Code. If tip payment QR codes concern you, read about Venmo QR code scams. Related reading: bowling alley and arcade QR code scams and movie theater QR code scams.
Scan Every Code With Confidence
Download QRsafer for iOS or Android and preview the destination URL before any page loads. Whether it's a booking flyer, a waiver tablet, an in-room puzzle, or a tip card, one second of preview is all it takes to know whether you're scanning the real thing.