Poshmark QR Code Scam: What It Is and What to Do
A Poshmark buyer or seller sent you a QR code and something feels off. Trust that instinct. Legitimate Poshmark transactions never require a QR code — here's exactly what's happening and what to do about it.
The two Poshmark QR code scams
Scammers exploit both sides of the Poshmark transaction. Whether you're buying or selling, the goal is the same: pull the deal off-platform, where Poshmark's purchase protections can't help you.
1. The fake authentication or verification QR (buyer scam)
You're interested in a listing and the seller messages you — through Poshmark's system, an Instagram DM, or a text — with a QR code. They claim you need to scan it to "authenticate your account," "activate buyer protection," or "confirm the shipping label." The pitch sounds official enough to seem routine.
The QR code leads to a convincing Poshmark lookalike page designed to capture your login credentials or payment details. Once the scammer has your account access, they can drain any linked payment methods, post fraudulent listings under your name, or sell your personal information.
2. The overpayment refund or direct payment QR (seller scam)
You've listed an item and a "buyer" claims they accidentally overpaid and needs you to scan a QR code to process a refund — or they want to bypass Poshmark's payment system with a "direct payment" that gets you your money faster.
No overpayment occurred, and no real buyer is involved. The QR code funnels you through a fake payment flow where you end up sending money to the scammer, or it harvests your banking credentials through a phishing form. Never ship any item until the sale is fully settled within Poshmark's platform — not until a buyer "confirms" payment through a link or QR code they sent you.
Why Poshmark transactions never need a QR code
Poshmark's platform handles every step of a legitimate transaction — payment processing, shipping label generation, and purchase protection — entirely within the app. Poshmark does not generate QR codes for:
- Account authentication or identity verification
- Buyer protection enrollment or confirmation
- Activating or verifying shipping labels
- Payment release or overpayment refunds
- Any other step in a buyer or seller transaction
If someone asks you to scan a QR code at any point in a Poshmark deal, the safest assumption is that it's a scam. The same off-platform pressure tactic is common on eBay, OfferUp, and Facebook Marketplace — any peer-to-peer marketplace where scammers can contact buyers and sellers directly.
What to do right now
Whether you scanned the code, entered information, or sent money, here's how to respond:
- If you only scanned and didn't enter anything, you're likely fine. Check for any unexpected app installs, new browser extensions, or configuration profiles (iOS: Settings → General → VPN & Device Management) that you didn't add.
- If you entered your Poshmark login, change your password immediately from a trusted device and turn on two-factor authentication. Update the same password on any other accounts where you reused it. Check your Poshmark account for unauthorized purchases, new listings, or changes to your payment or shipping details.
- If you entered payment information, call your bank or card issuer right away and report it as fraud. Ask whether a chargeback is available — acting within hours gives you the best chance of recovering funds.
- If you sent money via Zelle, Cash App, Venmo, or wire transfer, contact the payment platform's fraud team immediately. These transfers are often irreversible, but prompt reporting is still critical.
- Report the Poshmark account. Go to the user's profile in the app, tap the three-dot menu, and select "Report." You can also contact Poshmark support directly at support.poshmark.com. Getting the fraudulent account suspended protects other sellers and buyers.
- File a report with the FTC at reportfraud.ftc.gov and with the FBI's Internet Crime Complaint Center at ic3.gov. Include the Poshmark username, listing URL, and any screenshots of the QR code or messages.
How to stay safe on future Poshmark transactions
- Scan any QR code with QRsafer first. Before opening a URL from any QR code, QRsafer checks the destination for phishing, malware, and fraud signals and gives you a clear verdict in seconds.
- Keep every transaction inside Poshmark. Poshmark's in-app purchase protection only applies to transactions completed through the platform. Moving off-platform — for any reason — voids all protections.
- Verify sales in your Poshmark account directly. If a buyer claims to have paid, check your Poshmark earnings in the app. Never confirm payment based on a QR code or external link the buyer sends you.
- Be skeptical of off-platform contact. If a buyer or seller asks to move to text, email, or Instagram to "simplify" the transaction, treat it as a red flag. Poshmark's in-app messaging is your documentation and dispute record.
Frequently asked questions
Does Poshmark ever ask buyers or sellers to scan a QR code?
No. Poshmark's built-in payment system processes every transaction entirely within the app. Poshmark never generates QR codes for authentication, shipping label activation, buyer protection verification, or any other step in a transaction. Any QR code sent by another user — whether through Poshmark's messaging system, a text, or an Instagram DM — is a red flag and likely part of a scam.
I scanned a QR code from a Poshmark seller and entered my login. What do I do?
Act immediately: change your Poshmark password from a trusted device and enable two-factor authentication, update the password on any other account where you use the same credentials, and check your Poshmark account for unauthorized activity or listings. Report the seller to Poshmark via the in-app reporting tool and notify Poshmark support directly. If payment info was also entered, contact your bank or card issuer right away.
How can I check whether a QR code sent through Poshmark is safe?
Scan it with QRsafer before opening anything. QRsafer checks the destination URL against multiple threat intelligence sources and gives you a plain-language Safe, Risky, or Dangerous verdict — so you know what you're opening before you tap. That said, the safest rule on Poshmark is this: if someone sends you a QR code at any point in a transaction, don't scan it. Legitimate Poshmark deals never require one.
Check any QR code before you scan
QRsafer checks the destination URL before you open it — so you know whether a QR code is safe before you tap, pay, or ship anything. Free on iOS and Android.