Car Dealership QR Code Scam: What It Is and What to Do

How car dealership QR code scams work

Car transactions are high-stakes by nature — they involve Social Security numbers for loan applications, bank account details for down payments, and sums in the tens of thousands of dollars. That combination makes dealerships an attractive target, and scammers run three distinct attacks in this environment.

Fake financing or payment QR codes in dealer-branded mailers. You receive a professional-looking mailer from what appears to be your dealership or its finance partner — sometimes timed around a new vehicle purchase you recently made. The letter urges you to "complete your financing verification" or "confirm your payment setup" by scanning a QR code. The page mimics the dealer's or lender's login portal and requests your SSN, income details, and bank account number. Because you just bought a car and are expecting follow-up paperwork, the timing feels plausible and victims comply before questioning the URL.

Tampered QR codes in the service department. Service-department waiting rooms and service lanes often display QR codes on posters or kiosk screens — for scheduling, checking repair status, or accessing the customer portal. Attackers place sticker QR codes over these legitimate codes or swap out kiosk displays, redirecting customers to a phishing login page styled as the dealership's customer portal. The page harvests your account credentials, which may be linked to your payment method and vehicle history. Service customers are particularly vulnerable because they're already in "I need to take care of something" mode.

Fake "dealer invoice" QR codes in business email compromise attacks. This variant targets buyers who recently inquired about a vehicle online. An attacker who has intercepted or spoofed a dealership email sends a realistic-looking invoice or purchase agreement with a QR code to "review and authorize the transaction." The QR code leads to a fake payment page that redirects the buyer's down payment to the attacker's account. Because the buyer is actively expecting contract documents, the fraudulent email arrives at exactly the right moment to be convincing.

For a broader look at how fake invoices with QR codes are used to redirect business payments, see the fake invoice QR code scam guide.

Why these scams are effective

Car buying is one of the most document-heavy consumer transactions Americans make. Buyers routinely hand over their SSN, proof of income, insurance details, and banking information during the financing process — so providing that same information on a QR-linked page doesn't immediately trigger alarm bells. The high emotional investment (excitement about a new vehicle, stress about financing) and the time pressure of dealership visits further reduce vigilance.

The key rule: never enter SSN, banking details, or login credentials on a page you reached via a QR code in a dealership context. Always navigate to the dealer's official website directly by typing the address you know, or call the dealership's main number to verify any document before acting on it.

What to do right now

If you only scanned and closed the page without entering anything: Your risk is low. Don't return to the URL. If you noticed a suspicious sticker QR code on dealership property, alert the service department or a manager so they can remove it.

If you entered your SSN or personal financial information:

1. Place a credit freeze immediately with Equifax, Experian, and TransUnion. A freeze is free and prevents new credit from being opened in your name until you lift it.
2. File an identity theft report at IdentityTheft.gov — the FTC will create a personalized recovery plan.
3. Notify your bank or lender if you entered account details, and ask them to flag your account for suspicious activity.
4. Alert the dealership directly using a phone number from their official website so they can warn other customers and investigate.

If you wired or transferred a down payment to a fraudulent account: Contact your bank immediately — wire recalls are time-sensitive and may be possible within the first 24–48 hours. File a report with the FBI's Internet Crime Complaint Center at ic3.gov and with your state attorney general.

For more on how scammers impersonate financial institutions in QR attacks, see the bank QR code scam guide.

Frequently asked questions