A round of golf feels like a world apart from the parking-meter scams and smishing texts that make the news. But the same QR code attacks that hit gas stations, coffee shops, and rideshare pickups have quietly moved onto the course — and the high-trust, relaxed atmosphere of a club environment is exactly what makes golfers vulnerable.
Here are the four variants that matter.
Variant 1: Fake tee-time booking QR codes
Before you even set foot on the first tee, scammers can reach you through a QR code.
Fraudulent social media posts and physical flyers — near parking lots, on community boards, or slipped under windshields — advertise tee times or discounted rounds with a QR code to "book now." The code leads to a convincing replica of GolfNow, TeeOff, or the club's own booking page: same color scheme, same form fields, a confirmation email that either never arrives or is a fake.
What the scammer collected: your name, email, phone number, and full card details. The tee time doesn't exist.
The tell: Legitimate booking platforms send an immediate confirmation with a booking number, course name, and cancellation policy. If you don't receive one within a minute, call the course directly using the number on their official website — never the one listed on the flyer.
Variant 2: Beverage-cart payment QR sticker swaps
This is the most physically accessible attack on a golf course.
Beverage carts accept cashless payments via a printed QR code — often a Venmo, Square, or PayPal handle — laminated on a card attached to the cart or displayed on a small stand. An attacker who knows the routine visits early in the day and places a sticker over the legitimate code. The sticker directs to a payment page the attacker controls.
Because the cart staff is busy, the transaction amount is relatively small ($5–15), and golfers are relaxed and trusting, many victims never scrutinize the payee name before confirming.
The tell: Always check the payee name on the confirmation screen before tapping "Pay." If it doesn't match the course name or a recognizable vendor, cancel immediately and pay another way.
Variant 3: Pro-shop loyalty and lesson-booking QR codes
The clubhouse creates a second attack surface.
Printed cards for pro-shop loyalty programs, lesson-booking sign-ups, and merchandise promotions are routinely left on counters, tables, and display stands — locations anyone can access during business hours. An attacker replaces a card or places a sticker over the legitimate QR code, directing victims to a phishing page that harvests login credentials or payment details under the guise of joining a loyalty program or reserving a lesson slot.
This variant is particularly effective because victims are already inside the trusted environment and the ask (join the club's loyalty program) feels completely routine.
The tell: The destination URL should include the club's own domain. If the URL preview shows an unfamiliar domain or a shortened link, don't tap — ask the pro shop staff to show you how to sign up through their official website instead.
Variant 4: Fake members-only tournament registration QR codes
The most targeted attack comes via email or text.
Scammers obtain member lists — sometimes from a data breach, sometimes simply by registering as a guest — and send messages impersonating the club. The message advertises a members-only tournament, a charity scramble, or a special event, with a QR code to register and pay the entry fee. The page harvests both the entry fee and any personal data submitted on the form.
This variant peaks during popular tournament seasons (spring and fall) and around charity events, when members are especially likely to sign up quickly without questioning an email that looks official.
The tell: Real club communications about paid events link to the club's own website or a known registration platform like SignUpGenius. If a tournament email asks you to scan a QR code and pay via an unfamiliar payment page, call the club directly before submitting anything.
What to do if you entered payment information
If you entered card details on a page that turned out to be fraudulent:
- Call your card issuer immediately. Report the transaction as potentially fraudulent. Most issuers can flag or freeze the card number within minutes.
- Request a replacement card number. Even if no fraudulent charges have appeared yet, compromised card data is typically sold or used within 24–48 hours.
- Review recent transactions. Flag any charges you don't recognize, no matter how small — small test transactions often precede larger fraud.
- File a report at reportfraud.ftc.gov so the attack is on record.
What to remember on the course
- The relaxed, high-trust atmosphere of a golf course or country club is the scammer's most useful asset. Slow down by two seconds before scanning.
- Verify the payee name on any QR payment before confirming.
- Book tee times through the club's official website or a trusted platform — never through a QR code on a sign or social media post you weren't expecting.
- The same sticker-swap attacks that hit restaurants and bars work on beverage carts and clubhouse counters for the same reasons.
See also
- What to Do If You Scanned a Suspicious QR Code
- Restaurant QR Code Scams
- Bar and Nightclub QR Code Scams
- Venmo QR Code Scam
- QR Code Threat Map
Download QRsafer for iOS or Android and scan any course or club QR code before your browser opens it. Two seconds on the first tee is a small price for the peace of mind that follows.