Craigslist QR Code Scam: What It Is and What to Do

Someone in a Craigslist deal sent you a QR code and something feels off. Good instinct. Legitimate Craigslist transactions never require a QR code — here's what's really going on and what to do about it.

The three Craigslist QR code scams

Scammers adapt the QR code trick to whichever role they're playing in the transaction — buyer, seller, or landlord.

1. The fake payment confirmation (buyer scam)

You're selling something. The "buyer" says they've paid you via Zelle, Venmo, or a money order — and sends a QR code as "proof of payment." They may also say you need to scan it to "accept" or "release" the funds.

The QR code leads to a phishing page designed to look like your bank, Zelle, or Venmo. If you log in, the attacker takes your credentials. No payment was ever sent to you.

2. The "release your payment" QR code (seller scam)

You're buying something. The seller says they use an escrow or peer-to-peer payment platform and sends a QR code to "complete your purchase" or "verify your identity before they ship." The QR code leads to a fake payment page — you're being asked to pay someone you don't know.

This variant often involves unusually good deals on high-demand items: concert tickets, electronics, game consoles. The pressure to move fast is part of the script.

3. The rental deposit QR code

A landlord or property manager lists a rental on Craigslist at a below-market price. To "hold" the unit, they ask you to pay a deposit via a QR code — before you've seen the property or signed anything. The listing is fake. The money goes to a scammer.

This is the same scheme covered in more detail on the rental QR code scam page. Craigslist rental listings are a primary vector because they attract a large, motivated audience with little platform-side buyer protection.

Why Craigslist transactions never need a QR code

Craigslist has no integrated payment system. Its official guidance is simple: meet in person, pay in cash. No legitimate Craigslist transaction — whether you're buying, selling, or renting — requires you to scan a QR code at any point.

Craigslist does not generate QR codes for:

  • Payment confirmation or receipt
  • Releasing funds held in escrow
  • Identity or age verification
  • Scheduling pickups or viewings
  • Any other step in a transaction

If the other party insists that scanning a QR code is required to complete the deal, the deal is a scam. Full stop.

The same logic applies to Venmo QR code scams used in person: real Venmo payments don't require the recipient to scan anything — you simply open the app and send.

What to do right now

Whether you scanned the code, entered information, or sent money, here's how to respond:

  1. If you only scanned the code and didn't enter anything, you're likely fine. Check your device for any unexpected app installs, new configuration profiles (iOS: Settings → General → VPN & Device Management), or browser extensions you didn't install.
  2. If you entered login credentials, change your password on that account immediately from a trusted device. Change it on any other accounts using the same password. Enable two-factor authentication.
  3. If you entered payment information, call your bank or card issuer and report the transaction as fraud. Ask whether a chargeback is possible. Act within hours — the faster you move, the better your odds of recovery.
  4. If you sent money via Zelle, Venmo, or a wire transfer, contact the payment platform's fraud team immediately. Zelle transfers are typically irreversible; report it to your bank anyway and file a dispute. Venmo has a fraud reporting flow in the app under Help → Contact Us.
  5. Report to the FTC at reportfraud.ftc.gov and to the IC3 (FBI's Internet Crime Complaint Center) at ic3.gov. Include the Craigslist listing URL, the scammer's contact info, and any QR code images you have.
  6. Flag the Craigslist listing using the "prohibited" flag on the post so other users are warned.

How to protect yourself before the next deal

  • Scan any QR code with QRsafer first. It checks the destination URL for phishing, malware, and fraud signals before you open anything — and gives you a plain-language verdict in seconds.
  • Cash in person, always. For local Craigslist deals, this is still the safest method. Meet in a public place (many police stations offer "safe exchange zones"), and inspect the item before handing over money.
  • Never pay before you see it. For rentals or high-value items, refuse any request for upfront payment before an in-person viewing. Legitimate landlords and sellers don't require a deposit to see a property or hold an item sight-unseen.
  • Verify the payment actually arrived before handing over an item. Log in to your bank or payment app directly — never via a link or QR code they sent you — and confirm the balance before you release anything.

Frequently asked questions

Does Craigslist ever send QR codes as payment confirmation?

No. Craigslist does not generate QR codes for payment confirmation, cash release, or identity verification. If someone in a Craigslist transaction sends you a QR code for any of those purposes, it is a scam. Craigslist recommends cash-only, in-person transactions for local deals.

I scanned a QR code a Craigslist buyer sent me. What do I do?

If you entered any personal or financial information on the page the QR code opened, act immediately: change passwords for any accounts you entered credentials for, contact your bank if payment details were shared, and report the incident to the FTC at reportfraud.ftc.gov. If you only scanned the code but didn't enter anything, you're likely fine — but check your device for any unexpected app installs or profile changes.

How can I tell if a QR code from a Craigslist contact is safe?

Scan it with QRsafer before opening anything — it checks the destination URL against multiple threat intelligence sources and returns a clear Safe, Risky, or Dangerous verdict. Beyond that: a legitimate Craigslist transaction will never require you to scan a QR code. If someone insists, treat it as a scam.

Check any QR code before you scan

QRsafer checks the destination URL before you open it — so you know if a QR code is safe before you tap, pay, or hand anything over. Free on iOS and Android.

Related guides