Gift Card QR Code Scam: What It Is and What to Do
Got a gift card with a QR code that seems off — or were you asked to pay via gift card and scan a code? Here's exactly how both scams work and what to do if you already scanned.
The two gift card QR code scams
Gift card fraud splits into two distinct attack patterns. Knowing which one you're facing determines exactly what you should do next.
Tampered gift card packaging. Attackers visit retail stores and place small QR code stickers over the legitimate balance-check or activation codes printed on gift card packaging. When you buy the card and scan the QR code to check your balance or set up an account, you land on a phishing site — not the real retailer. The site collects your login credentials, email address, or in some cases payment details. The gift card value may also have already been drained before you purchased it.
Coerced gift card payment with a QR code. In this variant, an attacker contacts you — by phone, text, or email — posing as the IRS, Social Security Administration, Microsoft, Apple, a utility company, or even a family member in an emergency. You're told you owe money, your account is about to be suspended, or someone needs urgent help. The payment instruction: buy a gift card, scratch off the PIN, and either read it out loud or scan a QR code to "transfer" the funds.
Why gift cards? Because they work like cash. Once an attacker redeems the code, the balance is gone — and unlike a credit card chargeback or a bank wire dispute, there is no reversal process. The irreversibility is the entire reason attackers choose this payment method — it's the same logic behind crypto QR code scams.
The single most reliable fraud signal
No government agency will ever ask you to pay via gift card. Not the IRS. Not Social Security. Not your local utility. Not a court. Not a tech support team. Not a customs officer. This is not a gray area — it is a categorical rule with no legitimate exceptions.
If someone asks you to pay any kind of debt, fine, or fee by purchasing a gift card and scanning a QR code, the conversation is a scam regardless of how official the caller sounds, how urgent they say the situation is, or what caller ID shows on your phone.
Hang up. Do not call back. Do not scan the code.
What to do right now
Your response depends on which situation you're in.
If you scanned a QR code on gift card packaging and were taken to an unfamiliar site:
- Close the page immediately without entering any information.
- If you did enter credentials — email, password, or a PIN — change those passwords right now, starting with your email account.
- Contact the gift card retailer (Amazon, Target, Visa, etc.) directly using the number on their official website to check whether the card has been compromised.
- Report the tampered packaging to the store where you bought it so they can pull affected inventory.
If you were asked to pay via gift card and already sent the code or PIN:
- Contact the gift card issuer immediately. Call the number on the back of the card and report fraud. Act within minutes — once the attacker redeems the code the money is gone, but a fast enough call can sometimes catch it.
- Save all evidence. Screenshot the QR code, the number or address that contacted you, and any message or email. You'll need this for every report you file.
- File a report with the FTC. Go to reportfraud.ftc.gov. The FTC uses these reports to build cases against fraud networks.
- Report to the FBI. File an internet crime complaint at ic3.gov, especially if the amount lost is significant.
For a full step-by-step recovery checklist after any suspicious scan, see what to do if you scanned a suspicious QR code.
Frequently asked questions
What is a gift card QR code scam?
A gift card QR code scam takes two forms: tampered packaging QR codes that lead to phishing sites when you scan to check your balance, and coerced payment scams where someone demands you buy a gift card and scan a QR code to send them money. In both cases, the goal is to steal money or credentials that cannot be recovered.
Someone asked me to pay with a gift card and scan a QR code — is this a scam?
Yes, without exception. No government agency, tech company, utility, or legitimate business asks for payment via gift card and QR code. This is one of the most reliable fraud indicators that exists. Gift card payments are irreversible — once an attacker redeems the code, the money cannot be recovered. Do not scan the code, hang up, and report the contact to the FTC at reportfraud.ftc.gov.
I scanned a QR code on a gift card and it asked for my information — what should I do?
Stop immediately — close the page without submitting anything. If you already entered a username or password, change those credentials right away starting with your email account. If you entered any payment or bank account details, contact your bank immediately. Report the incident to the FTC at reportfraud.ftc.gov and to the retailer whose card brand was impersonated.
See where a QR code actually goes before you scan it
QRsafer checks the destination URL against multiple threat intelligence sources and returns a Safe, Risky, or Dangerous verdict in seconds — before your browser opens anything. Free on iOS and Android.