International travel puts you in exactly the conditions scammers love: an unfamiliar environment, a phone full of sensitive accounts, and a reduced ability to spot fraud signals in a language you don't speak fluently. QR codes are increasingly the attack surface of choice — especially in countries where scanning a code to pay, board, or enter is as routine as tapping a credit card.
Here's what the threats look like and how to protect yourself before you leave.
QR payment scams in high-scan countries
In much of Southeast Asia — Thailand, Vietnam, Malaysia, Indonesia — and in mainland China, QR code payments aren't a novelty. They're the primary way people pay for everything from street food to hotel rooms. WeChat Pay, Alipay, PromptPay, and GrabPay all use QR codes natively.
This creates two problems for tourists.
First, scammers swap legitimate merchant QR codes with their own, routing payments to personal accounts. Because tourists don't know what the real merchant code looks like — and can't read the receipt confirmation screen in Thai or Vietnamese — they often don't notice the payment went to "John Smith" instead of "Pad Thai Restaurant."
Second, scammers near tourist attractions display QR codes for fake apps or currency exchange services. "Scan to get the best rate" is a common hook. The QR leads to a fake payment app that charges your card without delivering any exchange.
What to do: In high-scan countries, pay at official counters using your own bank card or a payment app you set up before traveling. If you use a local QR payment system, verify the payee name on your phone screen before confirming. Small vendors should have an official QR display with their business name — not a handwritten sign with a code.
Tourist-targeted scams at train stations and attractions
Scammers concentrate wherever tourists congregate and are time-pressured: train station ticket machines, entry queues at popular sites, currency exchange kiosks.
Common setups include:
- Fake ticket QR codes posted near the official machine claiming to let you "skip the line" — they collect your card details on a lookalike payment page and provide no ticket
- "Scan to register" entry codes near museum or temple entrances from people impersonating staff — leading to fake booking portals that charge non-refundable reservation fees
- Currency exchange QR codes at booths in tourist districts that offer a "better rate" — the page harvests card details without completing any exchange
The tell in every case: the URL behind the QR code doesn't match the official domain of the venue, transport authority, or exchange service. QRsafer checks this before your browser opens anything.
Fake Wi-Fi QR codes at hotels and airports
Fake Wi-Fi QR codes are a domestic scam too — but they're more effective abroad because travelers expect unfamiliar network names and are less likely to double-check with the front desk.
The attack is straightforward: a printed sign near the hotel lobby, airport lounge, or hostel common room displays a QR code for "Free Wi-Fi." Scanning it connects your device to an attacker-controlled hotspot. The attacker can then intercept unencrypted traffic, capture session cookies, or redirect you to a fake captive portal harvesting your email and password.
Hotels that legitimately use QR codes for Wi-Fi access always display them on official in-room materials or check-in cards — not on free-standing signs in hallways or public areas.
What to do: Ask a staff member for the Wi-Fi name and password verbally. If you do scan a Wi-Fi QR code, check that the network name matches exactly what's written on official in-room documentation before you stay connected.
The language-barrier vulnerability
Phishing pages targeting international tourists are often in English — sometimes better English than the scam pages targeting locals. This creates a false sense of legitimacy. You see a clean, professional-looking page in a familiar language, you trust it more than you should.
Additionally, error messages, security warnings, and URL details that would tip off a local speaker are invisible to someone who doesn't read the local alphabet. A scam page in Thai, Korean, or Arabic looks identical to a legitimate one if you can't read either.
What to do: Focus on what you can always check regardless of language — the URL. Before tapping anything on a page that appeared after a QR scan, look at the address bar. If it's a long random string, a URL shortener, or anything that doesn't match the name of the institution you expect, close it.
Practical checklist for travel abroad
- Payments: Use your bank card or an established app (Apple Pay, Google Pay) rather than scanning unfamiliar local payment QR codes
- Tickets and entry: Buy at official counters or the venue's official website — not from QR codes posted by unofficial helpers
- Wi-Fi: Get the network name from staff, not from a posted QR code
- Exchanges: Use official exchange counters at airports or banks; never scan a QR code at a street exchange booth
- URLs: Check the address bar before entering anything; use QRsafer to preview any code before your browser loads it
For more on the specific risks at airports, see our guide to airport QR code scams. For hotel-specific threats, see hotel QR code scams.
See also
- Fake Wi-Fi QR Code Scam
- Airport QR Code Scams
- Hotel QR Code Scams
- What to Do If You Scanned a Suspicious QR Code
- QR Code Threat Map
Download QRsafer for iOS or Android and scan safer on every trip.