You've just arrived at the mountain after a four-hour drive. The parking lot is packed, your boots are already on, and you want to grab a lift pass before the lines get longer. A printed sign near the ticket area shows a QR code: "Scan here for discounted day passes."
You scan it without thinking.
That instinct — to solve the immediate problem quickly — is exactly what attackers count on at ski resorts. Guests are unfamiliar with the layout, handling large transactions under time pressure, and too cold to spend thirty seconds reading a URL carefully. Here are the four variants that show up most often.
Variant 1: Fake lift-pass purchase QR codes
This is the highest-stakes variant because lift passes are expensive and the transaction feels legitimate.
Attackers post signs on bulletin boards inside lodges, on parking-lot kiosks, near rental counters, or on exterior walls close to the ticket office. The sign mimics resort branding — same logo style, same color palette — and offers a QR code to "buy passes online" or "skip the line." The destination is a payment page designed to look like the resort's checkout flow. It collects your card number, expiration date, and CVV, then shows a fake confirmation. No ticket is issued.
The tell: Real resort ticketing QR codes appear only on the resort's official website and app — never on a separate printed sign near the parking lot. If you didn't navigate to the code yourself through the resort's official domain, go to the ticketing window instead.
Variant 2: Equipment rental deposit QR codes swapped by bad actors
Rental shops process dozens of deposits per hour during peak season. Busy staff, long lines, and a fast-moving process create the same opportunity as any high-traffic payment terminal.
An attacker places a sticker QR code on the rental counter — near the payment terminal, on a laminated instruction card, or on a "deposit required" placard — that leads to a fake payment page. In a crowded rental shop where everyone is rushing to get outside, it's easy to scan whatever is in front of you without verifying the destination.
The tell: Legitimate rental deposit transactions happen through a payment terminal you tap or swipe, or through the shop's own app. If a staff member asks you to scan a separate QR code to pay your deposit, ask them to process it through the standard terminal instead.
Variant 3: Trail-map and wayfinding QR codes on-mountain
Remote terrain is the ski resort's most exploitable surface. An attacker can access trailhead signs, lift-station bulletin boards, and warming-hut information panels early in the morning — often with no witnesses — and swap a legitimate QR code for a fake one in under a minute.
On-mountain signs are inspected for tampering far less frequently than urban storefronts. When a lost or unfamiliar skier scans a "download the trail map" code at a remote trailhead, they're not thinking about phishing — they need to know where they are.
The fake code typically leads to a page that either harvests an email and password (framed as a "resort app sign-in to access maps") or asks for payment to "unlock" a digital guide.
The tell: Official resort trail maps are always available free on the resort's website and app. Any QR code that asks for login credentials or payment to display a map is fraudulent.
Variant 4: Ski-lodge lodging and vacation-rental QR scams
Travelers booking ski-adjacent lodging on short notice — searching for the best rate on accommodation near the mountain — are a prime target for rental scams.
Scammers post fake listings on third-party platforms or send follow-up emails to travelers who inquired about lodging, providing a QR code for a "booking deposit" or "lease signing portal." The rental doesn't exist, or the listing is a copy of a real property with the payment details swapped. After the deposit is paid, contact goes silent.
The tell: Book lodging only through the platform where you found the listing, using that platform's built-in payment system. Any request to complete a booking through a QR code sent outside the platform is a red flag.
What to do if you entered payment or personal information
If you entered card details: Call your bank immediately, report the transaction as potentially fraudulent, and request a replacement card number.
If you entered a login: Change that password now, then change it anywhere else you used it. Enable two-factor authentication.
If you paid a rental deposit: File a dispute with your card issuer, contact the platform where the listing appeared, and report the fraud at reportfraud.ftc.gov.
What to remember on the slopes
- Buy lift passes through the resort's official website or app before you arrive, or at the physical ticket window on-site.
- Treat any QR code on a sign you didn't navigate to yourself as unverified until you've confirmed the URL.
- Remote terrain is easier to tamper with than urban environments — if a trail-side QR code asks for credentials or payment, don't scan it.
- The same scam that targets ski resorts operates at vacation rentals and amusement parks — the playbook is identical.
See also
- What to Do If You Scanned a Suspicious QR Code
- Vacation Rental QR Code Scams
- Amusement Park QR Code Scams
- How to Spot a Malicious QR Code Before You Scan
- QR Code Threat Map
Download QRsafer for iOS or Android and scan any resort QR code before your browser opens it. Two seconds of checking beats a fraudulent charge — and you can do it before your gloves come off.