Car Wash QR Code Scam: What It Is and What to Do

How the car wash QR code scam works

Unattended car wash kiosks — the pay stations at self-serve bays and automatic tunnels — are prime targets for QR code tampering. Staff rarely inspect them between customers, there are no cameras trained directly on the payment panel, and most patrons are distracted and in a hurry. That combination makes it easy for an attacker to spend thirty seconds placing a small sticker QR code directly over the one printed on the kiosk, then walk away.

When you scan the sticker, instead of opening the car wash operator's payment system, you land on a phishing page designed to look like a generic card payment form. You enter your credit or debit card number, expiration date, and CVV — and the attacker captures all of it in real time while you're standing in the bay waiting for the wash to start (which never does, or which the attacker may allow to proceed through a separate mechanism to delay your suspicion).

The second variant targets customers of high-volume coin-op and express washes. Attackers leave professionally printed flyers on windshields or post them near the entrance advertising a discounted "car wash club" or monthly membership — scan the QR code to lock in the rate. The form that opens collects full card details for what appears to be a recurring subscription. There is no membership; the card is simply charged or sold.

The mechanics closely mirror the gas station pump QR code scam and the EV charger QR code scam: all three exploit unattended outdoor kiosks where the legitimate QR code is easy to cover and rarely verified.

Real car wash payment page vs. phishing page: how to tell them apart

Knowing what a legitimate page looks like is your fastest defense. Take two seconds to check the URL before you tap in a single digit.

Signs of a legitimate car wash payment page:

• The URL matches the car wash operator's brand or a well-known payment processor (e.g., mistercarwash.com, tideycars.com, or a recognizable POS provider)
• The page shows the specific wash type and location you selected — it knows which bay or tunnel you're at
• Payment is processed through a recognizable checkout with a confirmation screen before any charge
• The branding — colors, logo, fonts — matches the signage you see at the actual wash

Red flags on a phishing page:

• A generic or lookalike domain that doesn't match the car wash operator's name
• A plain card form that asks for your number, expiration, and CVV on the very first screen, with no order or location summary
• No mention of which wash package or bay you selected
• Slightly off branding — compressed logo, wrong color, unfamiliar font
• A membership or subscription sign-up form that arrived via an unsolicited flyer rather than the car wash's own app or website

The safest habit: if the QR code takes you somewhere unfamiliar, close the browser and use the physical keypad and card reader on the kiosk instead. Tap-to-pay via your phone's wallet is also safer than a QR-initiated web payment form.

What to do right now

Your response depends on how far you got before you noticed something was wrong.

If you only scanned and didn't enter any payment information: Your risk is low. Close the browser tab, don't return to the page. If you still want a wash, pay at the physical terminal or use the car wash operator's official app.

If you entered your credit or debit card details, act immediately:

1. Call your card issuer now. Use the number on the back of your card — not a number from any page you visited. Report the card as potentially compromised and ask them to freeze it and issue a replacement.
2. Watch for small test charges. Attackers often run a $0–$1 authorization or a tiny transaction to verify the card is active before selling it or making larger purchases. Dispute any charge you don't recognize, no matter how small.
3. Alert the car wash operator. Tell the owner or the number on the kiosk sign what happened. They can inspect the pay station for sticker QR codes and remove them before the next customer is hit.
4. File a report with the FTC at reportfraud.ftc.gov. Your report helps the agency track fraud patterns and build enforcement cases.

For a full step-by-step recovery guide after any suspicious QR scan, see what to do if you scanned a suspicious QR code. For detailed advice on card compromise specifically, see QR code credit card scam: what happens and what to do.

Frequently asked questions