Grubhub QR Code Scam: What It Is and What to Do

The three Grubhub QR code scams

1. Fake “claim your Grubhub credit” texts and emails

You receive a text or email that looks like it came from Grubhub. It says you have an unclaimed credit, a promotional reward, or an account issue that needs attention. A QR code is included — scan it, the message says, to claim your credit or verify your account.

Scanning opens a convincing Grubhub login lookalike that captures your email address and password. Because Grubhub stores payment methods in your account, stolen credentials give attackers access to your saved cards and order history as well.

Grubhub does run real promotions, but they appear inside the app under the Offers tab or arrive as email links that go directly to grubhub.com. No legitimate Grubhub promotion is delivered as a QR code in a text message. If you want to check your account balance, open the app directly rather than following any link or code you received.

2. Fake missed-delivery bag stickers in apartment lobbies

This scam targets apartment buildings. A counterfeit Grubhub delivery notice — printed to look like an official order bag sticker or door tag — is left in the mailroom, on a door handle, or at a common area drop point. It says your order could not be delivered and includes a QR code to “reschedule delivery” or “pay a small redelivery fee.”

Scanning the code leads to a fake payment page designed to collect your name, address, and credit card number. There is no missed order — the notice was placed there to harvest payment information from anyone in the building who happened to order food recently and assumed the notice was for them.

Grubhub does not charge redelivery fees and never uses physical QR codes to arrange order reschedules. All delivery issues are handled inside the Grubhub app under Help.

3. Fake Grubhub+ free trial QR codes on social media and flyers

Posts on Instagram, TikTok, and Facebook — and printed flyers distributed near college campuses and apartment complexes — offer a free Grubhub+ subscription, a first-order discount, or a referral bonus accessible by scanning a QR code. The offer targets students and frequent delivery customers who know Grubhub+ is a real subscription service.

Scanning the code opens a fake sign-up page that collects card details to “start your free trial.” The card is charged immediately with no subscription created. Victims often do not notice the charge right away because the amount is designed to look plausible as a trial authorization.

Grubhub+ trials are activated inside the Grubhub app or at grubhub.com/plus — never through a QR code on a flyer or social media post.

Why Grubhub never uses QR codes this way

Grubhub's account management, order tracking, and support systems operate entirely inside the Grubhub app and at grubhub.com. Promotions are delivered through the app's Offers section or via official email from a grubhub.com sender address. Delivery confirmation uses the app's real-time tracking — not a separate QR code workflow.

There is no step in any legitimate Grubhub customer flow that requires you to scan a QR code sent by someone outside the app. That is the red flag: legitimate platforms keep sensitive account interactions inside their authenticated interfaces, not in text messages or printed stickers.

What to do right now

1. If you entered your Grubhub login, go to grubhub.com and change your password immediately. Log out of all active sessions in your account security settings. If the same password is used on any other account, change it there too.
2. If you entered card or bank details, call your card issuer right away. Report the information as compromised and request a new card number. Dispute any unauthorized charges.
3. Review saved payment methods. Log in to grubhub.com and remove any payment methods you don't recognize or that you want to replace with a new card number.
4. Report to Grubhub. Contact Grubhub support at grubhub.com/help and report the scam. If you received a physical fake bag sticker, photograph it for the report.
5. File an FTC complaint at reportfraud.ftc.gov. This creates a formal record and helps fraud analysts track emerging patterns.
6. Save evidence. Screenshot the QR code, the page it opened, and all messages you received. You will need these for your card issuer and any law enforcement report.

How to protect yourself going forward

• Manage your Grubhub account only inside the app or at grubhub.com. Never follow a QR code or a link from a text message or social media post to log in or claim a promotion.
• Scan any unfamiliar QR code with QRsafer first. QRsafer previews the destination URL against threat databases before anything loads. If the domain is not grubhub.com, it will flag the risk before you tap.
• Find promotions inside the app. Open Grubhub and check the Offers section. If a deal is not listed there, it is not a real Grubhub offer.
• Enable two-factor authentication. Go to your Grubhub account settings and turn on login verification. This prevents attackers from accessing your account even if they obtain your password.

Frequently asked questions