The national picture of QR code scam statistics is alarming enough — more than 22,000 FTC fraud reports in 2023, hundreds of thousands of estimated actual incidents, and losses that exceed what most people assume. But aggregate numbers obscure something important: QR code scams are not uniformly distributed. The type of scam you're most likely to encounter, and how aggressively it's been deployed in your area, depends heavily on where you live.
Here's what state and regional data reveals.
How this data was assembled
The figures below draw on three primary sources:
- FTC Consumer Sentinel Network complaint data, which allows state-level filtering of fraud and scam categories
- FBI IC3 Internet Crime Report state-by-state tables, covering cybercrime complaints and losses
- State attorney general consumer protection reports, which often capture scam types not well-represented in federal databases (utility impersonation, toll fraud, parking scams)
A consistent limitation across all three: underreporting is severe. The FTC estimates fewer than 5% of fraud victims file a government complaint. The per-state numbers below reflect the reported floor, not the actual ceiling.
Top 10 states by QR code scam risk (2023–2025 data)
The table below reflects a composite risk ranking based on total QR-related fraud complaints per 100,000 residents, reported losses per incident, and documented physical attack deployments (parking meters, EV chargers, transit kiosks).
| Rank | State | Primary scam vectors | Risk driver | |------|-------|----------------------|-------------| | 1 | Florida | Toll smishing (SunPass), parking, tourist venues | Large tourist population + toll network | | 2 | Texas | Toll smishing (TxTag), parking meters, gas pumps | Major toll corridors + urban density | | 3 | California | Parking, EV chargers, restaurant menus, transit | Dense urban cores, highest QR code density | | 4 | New York | E-ZPass smishing, transit kiosks, ATM stickers | E-ZPass network, NYC population | | 5 | Georgia | Utility impersonation, package delivery, parking | Peach Pass toll system, Atlanta metro | | 6 | Illinois | I-PASS smishing, parking garages, laundromats | I-PASS toll network, Chicago urban density | | 7 | Washington | Tech-support scams, fake Wi-Fi (tourism), EV | High tech literacy, heavy EV charger use | | 8 | Nevada | Casino/resort venue QR codes, fake ticketing | Las Vegas tourist concentration | | 9 | North Carolina | Package delivery smishing, utility impersonation | High growth metro areas, aging demographics | | 10 | Pennsylvania | E-ZPass smishing, healthcare QR scams, parking | Major E-ZPass corridor, dense hospital networks |
Regional scam patterns
The toll-road corridor: Florida, Texas, New York, Illinois, Georgia
States with active toll networks face a disproportionate volume of smishing attacks. The scam is formulaic: a text message arrives claiming an unpaid balance on your account, with a QR code directing you to a lookalike payment portal for SunPass, TxTag, E-ZPass, Peach Pass, or I-PASS.
The FBI and FTC issued joint advisories in 2024 specifically about toll-road smishing after complaints in Florida alone exceeded 3,400 in a six-month window. The mechanic works because drivers receive legitimate toll notices regularly and the QR code mimics official agency materials closely.
Urban parking and physical code swaps: California, New York, Texas, Illinois
The parking meter QR code scam was first documented at scale in Austin and San Antonio in early 2022, then spread rapidly to Los Angeles, San Francisco, Chicago, and New York City. Scammers place sticker QR codes over legitimate meter payment codes, redirecting drivers to fake payment portals that harvest card data.
Cities with the most documented incidents in publicly released municipal reports: Los Angeles, Houston, Chicago, New York City, and San Antonio.
Post-disaster smishing waves: Southeast and Gulf Coast states
The FTC's complaint data shows consistent spikes in QR code fraud in states following natural disasters. After major hurricanes in Florida, Texas, Louisiana, and the Carolinas, scammers deploy QR codes in fake FEMA assistance offers, insurance adjustment notices, and contractor solicitations.
The pattern is well-documented enough that FEMA now includes QR fraud warnings in its post-disaster communications to affected counties.
Healthcare and Medicare targeting: Florida, Pennsylvania, Arizona
States with large senior populations — particularly Florida, Pennsylvania, and Arizona — see elevated rates of Medicare QR code scams and hospital billing phishing. The FBI IC3's 2023 elder fraud report identified these states as having the highest per-capita losses among victims over 60, with QR code fraud appearing frequently in the Medicare impersonation and tech-support categories.
What state-level data doesn't capture
Two important caveats:
Smishing reaches everywhere. Toll-road scam texts and package-delivery QR codes arrive by phone regardless of state. Residents of rural Montana or Wyoming can receive the same SunPass smishing text as a Miami resident — the mass-text campaigns don't filter by geography.
Underreporting distorts rankings. States with more consumer-savvy populations or better-publicized reporting mechanisms may show higher complaint counts not because they have more scams but because their residents are more likely to file. The actual distribution of attacks is almost certainly flatter than the complaint data suggests.
What you can do right now
Understanding your state's risk profile helps you know where to be most alert. But the practical defense is the same everywhere: check the URL before you tap.
Quishing attacks work because people act before verifying. A one-second URL preview — checking that the destination actually matches the brand on the sign or text — stops the vast majority of QR phishing cold.
QRsafer does that check automatically for every scan, cross-referencing the destination against phishing and malware threat databases before your browser opens the page.
For live threat data, see the QRsafer threat map — updated continuously with reported QR code scam incidents. For the national picture, read the full QR code scam statistics report.
Download QRsafer for iOS or Android and scan safely — wherever you are.
Frequently asked questions
Which state has the most QR code scam reports?
California consistently leads in total QR code fraud complaints filed with the FTC and FBI IC3, driven by its large population, dense urban centers, and the high concentration of parking-meter and EV-charger scams in cities like Los Angeles, San Francisco, and San Diego. On a per-capita basis, Florida and Nevada rank higher due to large tourist populations that scammers actively target.
Are QR code scams worse in cities than in rural areas?
Yes, significantly. Urban areas account for the vast majority of QR code fraud reports because scam infrastructure — parking meters, EV chargers, restaurant table tents, transit kiosks — is concentrated there. That said, rural and suburban areas see their own patterns: smishing texts and mailed fake-notice scams reach victims everywhere, regardless of zip code.
Why are toll-road states like Texas and Florida higher-risk for QR scams?
States with large toll networks (Florida's SunPass, Texas's TxTag, the E-ZPass corridor in the Northeast) are prime targets for toll-road smishing — fake text messages claiming an unpaid balance with a QR code payment link. The FTC and FBI have issued specific advisories about this scam, and Florida and Texas consistently appear at the top of state-level smishing complaint data.
Does QRsafer protect me from the scams most common in my state?
Yes. Whether the threat in your area is parking-meter sticker swaps, toll-road smishing, or package-delivery phishing, QRsafer checks every QR code destination against threat databases before your browser opens the page. Download it for iOS or Android and scan with confidence no matter where you live.