PNC Bank QR Code Scam: What It Is and What to Do

How PNC Bank QR code scams work

PNC is one of the top-ten largest banks in the United States, serving millions of customers across the South, Midwest, and Mid-Atlantic — and that reach makes it a frequent target for impersonation. Scammers exploit the PNC brand because a large share of their blast messages will land with real PNC customers who find them credible.

The scam arrives through four main channels:

• Smishing texts: A text arrives with PNC's logo and a message like “Suspicious charge detected on your PNC account. Scan the QR code to verify or your account will be restricted.” The code leads to a convincing PNC login clone that captures your username, password, and sometimes a one-time passcode.
• Fake PNC Points or rewards mailers: Physical mail or email mimicking PNC's promotional communications promises bonus cash back or an interest-rate upgrade on your savings account — just scan a QR code to “activate the offer.” The link harvests your PNC online banking credentials.
• ATM and branch-lobby sticker scams: Fraudulent QR code stickers placed over legitimate codes on PNC ATM screens, deposit-slip kiosks, or lobby informational displays redirect you to a phishing login page instead of PNC's real site.
• Fake BBVA account-migration QR codes: When PNC acquired BBVA USA, scammers sent fake “mandatory account integration” notices to former BBVA customers, complete with QR codes to “link your accounts.” Bank mergers create a window of heightened confusion that attackers exploit — the same tactic has appeared in other acquisition announcements since.

Using a QR code instead of a plain link bypasses email security filters that flag suspicious URLs and forces you onto your phone, where the phishing page fills the screen and the URL bar is easy to overlook. This technique is called quishing, and it is rising specifically because mobile browsers make URLs harder to inspect.

What PNC actually does — and never does — with QR codes

PNC does use QR codes in limited, controlled ways:

• In-branch marketing displays and printed promotional materials
• Deep links inside the PNC Mobile Banking app
• App download links on PNC's official website

PNC will never send you an unsolicited QR code to:

• Verify your identity or log you into your account
• Unlock, unfreeze, or reinstate a restricted account
• Confirm, authorize, or dispute a transaction
• Activate a reward, bonus, or interest-rate upgrade
• Migrate or link your account after an acquisition

Every legitimate PNC security action happens inside the PNC Mobile Banking app or at pnc.com — not through an unsolicited QR code in a text, email, or mailer. If a code is creating urgency around account access or rewards, that urgency is the mechanism of the scam.

For more on how bank QR code scams work across all financial institutions, see our full guide.

What to do right now

Your response depends on what you did after scanning.

If you only scanned and didn't enter anything: Your risk is low. Close the page, do not return to it, and monitor your PNC accounts closely for the next 48 hours.

If you entered your login credentials, card number, or any personal information, act immediately:

1. Call PNC fraud support now. The number is 1-888-762-2265. Do not use any phone number or contact details listed in the suspicious message.
2. Ask them to freeze your online banking access. This blocks an attacker from making transfers or changes while you work through recovery.
3. Change your PNC password from a trusted device on a trusted network — not the device or connection you used when you scanned the code.
4. Enable two-step verification in the PNC Mobile Banking app security settings if it is not already active.
5. Review recent transactions for any charges, transfers, or payee changes you did not make. Report each one to PNC as unauthorized.
6. File a report with the FTC at reportfraud.ftc.gov and with the CFPB at consumerfinance.gov/complaint.

For a complete recovery checklist that covers every type of financial QR scam, what to do if you scanned a suspicious QR code walks through each step in order.

How to protect yourself before you scan

The scam works because the fake PNC page looks convincing. You cannot rely on the design alone — you need to check the URL before your browser opens anything.

• Scan with QRsafer first. It analyzes the destination URL against threat intelligence sources and returns a verdict before your browser loads anything. A cloned PNC login page will not pass a threat check.
• Verify the domain before entering anything. PNC's real domain is always pnc.com — nothing else. Attackers use lookalikes like pnc-secure-verify.com or mypncalert.net. Check the full URL, not just the logo on the page.
• Never log in to PNC through a QR code. If a code claims to require your banking credentials, open the PNC Mobile Banking app directly instead. It takes ten seconds and eliminates the risk entirely.
• Call PNC to verify unexpected messages. Received a text, email, or mailer with a QR code from PNC? Call 1-888-762-2265 and ask if they sent it. If they did not, you have just avoided the scam.

For a broader guide to identifying suspicious codes in real time, how to spot a malicious QR code before you scan covers visual and contextual signals across every type of QR scam.

Frequently asked questions