Utility Company QR Code Scam: What It Is and What to Do

Real utilities never demand immediate QR-code payment under shutoff threat

Legitimate utility companies — Con Edison, PG&E, ComEd, National Grid, Dominion Energy, and every other regulated provider — are required by state public utility commissions to follow a formal disconnection process. That process includes advance written notice, a minimum notice period (typically 10–30 days depending on the state), and a clear dispute or payment-arrangement pathway before service is ever cut.

No real utility will leave a door hanger saying your power goes off in two hours unless you scan a QR code right now. That level of urgency, combined with a QR code as the only payment option, is the scam's signature. Legitimate shutoff notices direct you to the company's official payment portal (accessed by typing the URL yourself), a phone number, or a payment center — not a QR code.

The three variants of the utility QR code scam

The door-hanger variant is the most aggressive form. Scammers drive through neighborhoods and place printed notices on doors — sometimes targeting areas where non-English speakers are concentrated, since a language barrier makes it harder to call and verify. The hanger uses real utility logos (copied from the internet), a fake account number, and a QR code labeled "Pay Now to Avoid Disconnection." The QR code leads to a fake payment page styled to look like the utility's billing portal.

The mailed-letter variant is more sophisticated. It arrives in an envelope that mimics a real shutoff notice — same fonts, same layout, even a fake customer service number. The letter claims a past-due balance and instructs you to scan the QR code to make an immediate payment or call the (fake) number. The QR code and phone number both lead to the scammer.

The text-message variant is the simplest and easiest to spot. A text from an unknown number claims to be your utility provider and includes a QR code or short link. Real utility companies do not initiate urgent payment demands over SMS from unverified numbers. Because quishing attacks use QR codes specifically to bypass spam filters, the code may arrive even when suspicious links would be blocked.

What to do if you received a suspicious utility notice

Do not scan the QR code. Instead, call your utility company using the phone number printed on a previous paper bill or on your account statement — not any number on the suspicious notice. Ask them directly whether your account has a past-due balance and whether a shutoff notice was issued. If your account is current, you have confirmed it is a scam. If there is a real balance, the representative will direct you to a verified payment method.

If you already scanned and paid:

1. Call your bank or card issuer immediately. If you paid by credit or debit card, report the charge as fraud and request a chargeback. Act within hours — the sooner you call, the better your chances of recovering the funds.
2. Report to the FTC. File a fraud report at reportfraud.ftc.gov. The FTC tracks these scams and uses reports to build enforcement cases.
3. Report to your state public utilities commission. Most states have a consumer complaint process for utility fraud — your report helps regulators alert other customers.
4. Report to local police if you received a door hanger. Scammers who work door-to-door often cover entire neighborhoods; a police report can help stop them before more households are hit.
5. Monitor your accounts. If you entered card details on a fake payment page, watch for unauthorized charges and consider asking your bank to reissue your card.

Why this scam works — and how to protect yourself

The threat of losing electricity, heat, or running water is one of the most effective fear triggers scammers use. Unlike a suspicious email about a prize, a shutoff notice feels immediately consequential — especially for families with children, elderly residents, or people who depend on medical equipment. The urgency is manufactured specifically to stop you from pausing and verifying.

• Check QR codes with QRsafer before scanning. QRsafer shows you the destination URL and a safety verdict before your browser loads the page. A fake utility payment portal will not pass a threat check.
• Keep your utility account number handy. Your real account number appears on every paper bill. If a notice shows a different account number, it is fake.
• Know your utility's real contact number. Save it in your phone so that when a scam notice creates panic, you can verify in 60 seconds instead of reacting.

This same playbook — impersonating a trusted institution with an urgent QR code — is used by IRS scammers and bank QR code scammers. In every case, the defense is the same: slow down, verify through a channel you control, and never let urgency override judgment.

Frequently asked questions