Instacart QR Code Scam: What It Is and What to Do
You received a QR code that supposedly came from Instacart — by text, email, or from a shopper during an active order. Instacart never contacts customers or shoppers this way. Here are the two scam patterns behind those codes and the exact steps to take if you already scanned.
The two Instacart QR code scams
1. Customer phishing — fake account suspension or refund notice
You receive a text or email claiming your Instacart account has been suspended, a recent delivery could not be verified, or a refund is pending but requires confirmation. The message instructs you to scan a QR code to "restore access" or "claim your refund." Scanning opens a convincing Instacart login lookalike that captures your email, password, and sometimes your stored payment details.
Instacart never contacts customers by text with a QR code to verify accounts or authorize refunds. All order status updates, receipt access, and support tickets are handled entirely within the Instacart app or at instacart.com. If you receive one of these messages, go directly to instacart.com and log in there — never through a QR code or link in a text.
2. Shopper-targeting scam — fake vendor coupons and substitution codes
This variant targets Instacart shoppers (the people fulfilling orders in-store). Fraudsters contact shoppers through unofficial channels or plant fake listings, then supply a QR code claiming to be a "wholesale substitution code," "vendor coupon," or "in-store pickup confirmation." Scanning the code takes the shopper to a phishing page or prompts a malicious app download — it never serves any legitimate in-store purpose.
Instacart shoppers receive all item details, substitution guidance, and order management through the official Instacart Shopper app. No external QR code is ever required to complete a shop or confirm a substitution. If you receive one of these codes during a shop, do not scan it — report it through the Instacart Shopper app's support channel immediately.
Why Instacart never uses QR codes this way
Instacart's entire delivery workflow — order placement, real-time communication, substitution approval, payment, and receipt — is contained within the Instacart app. When a shopper needs input from a customer, the app sends an in-app message or push notification. When Instacart needs to contact you about your account, it uses verified email from an instacart.com address.
There is no step in any legitimate Instacart flow that requires scanning an externally supplied QR code. That's the tell — any QR code arriving by SMS, WhatsApp, or from a shopper outside the app is operating outside Instacart's verified systems.
What to do right now
- If you entered your Instacart login, go to instacart.com immediately, change your password, and sign out of all active sessions. Enable two-step verification under Account Settings.
- If you entered card or bank details, call your card issuer right away and report the information as compromised. Request a new card number and ask about reversing any pending charges.
- Report to Instacart. Open the Instacart app, go to the Help section, and report the fraudulent QR code. If a shopper was involved, include the order number so Instacart can review the account.
- File an FTC complaint at reportfraud.ftc.gov. This creates a formal record and contributes to fraud-pattern tracking that helps protect other shoppers and customers.
- Report to the FBI's IC3 at ic3.gov if you lost money or significant personal data was exposed.
- Save evidence. Screenshot the QR code, any pages it opened, and all messages you received. You will need these for your bank dispute and any law enforcement report.
How to protect yourself going forward
- Manage your Instacart account only inside the app or at instacart.com. Never log in through a QR code or link received by text or email.
- Scan unfamiliar QR codes with QRsafer first. QRsafer previews the destination URL against threat databases before you open it. If the link doesn't resolve to an official instacart.com domain, it will flag the risk before any page loads.
- Handle all shopper communication through the app. If a shopper contacts you outside the Instacart app — by text, WhatsApp, or any other channel — treat it as a red flag and report it.
- Enable two-step verification. Even if a scammer captures your password, two-step verification prevents account access without your phone.
Frequently asked questions
Does Instacart ever send QR codes to customers?
Instacart does not send QR codes by text or email to verify accounts, confirm deliveries, or process refunds. All legitimate Instacart order status updates, receipts, and customer support happen inside the Instacart app or at instacart.com. Any QR code sent to you by a third party claiming to be Instacart is a scam.
My Instacart shopper sent me a QR code during my order — should I scan it?
No. Instacart shoppers have no legitimate reason to ask customers to scan a QR code. Substitutions, order adjustments, and delivery confirmations are handled entirely through the Instacart app. If a shopper sends you a QR code, do not scan it. Report the incident through the Instacart app's Help section and contact Instacart support at instacart.com/help.
I scanned a QR code claiming to be from Instacart and entered my login — what do I do?
Go to instacart.com immediately and change your password. Log out of all active sessions and enable two-step verification under your account settings. If you also entered credit or debit card details, call your card issuer to report the information as compromised and request a new card number. File a complaint with the FTC at reportfraud.ftc.gov.
Check any QR code before you scan
QRsafer previews where a QR code actually leads — before you open it. Get a Safe, Risky, or Dangerous verdict in seconds. Free on iOS and Android.