Vending Machine QR Code Scam: What It Is and What to Do

How the vending machine QR code scam works

Modern vending machines increasingly support cashless payment through QR codes. Networks like Cantaloupe, 365Pay, Nayax, and PayRange let you scan a code on the machine to open a payment interface or download an app — no cash required. Attackers exploit this convenience by placing a printed sticker with a malicious QR code directly over the legitimate one on the machine's screen or payment panel.

The sticker is often professionally printed and positioned to look indistinguishable from the original. You scan, a payment page opens that looks plausible, you enter your card number, and you've handed your details to a phishing server. The attacker captures your card data in real time — often while you're still standing in front of the machine waiting for it to accept payment.

Vending machines are an attractive target for this scam for two reasons. First, they're typically unattended and located in offices, schools, hospitals, and gyms — locations with high foot traffic but minimal oversight. Stickers can sit in place for days or weeks without anyone noticing. Second, the transaction amounts are small — usually $2–$5 — which means many victims either don't notice the unauthorized charge on their statement or decide the hassle of disputing it isn't worth it. This low-friction outcome is exactly what attackers count on.

The mechanics are essentially identical to laundromat QR code scams, where sticker codes are placed over legitimate payment codes on shared washers and dryers. The same low-dollar, high-volume playbook applies.

The fake app download variant

A second variant targets older machines that don't yet support cashless payment but display a QR code on a nearby flyer or sticker claiming “Scan to download our payment app.” These QR codes don't lead to the App Store or Google Play — they lead to a website that either:

• Prompts you to install an APK file directly (Android only) — a file that contains a credential-stealing app or banking trojan
• Redirects to a fake payment form that harvests your card number before the “app” ever loads

The rule is absolute: legitimate vending payment apps are only distributed through the Apple App Store and Google Play Store. If a QR code on a machine asks you to download an app from any other source, close the page immediately.

How to tell a real payment page from a fake one

Signs of a legitimate vending payment page:

• The URL matches the payment network exactly — cantaloupe.us, 365pay.com, nayax.com, payrange.com
• The page shows the specific machine ID or vending location before asking for payment
• It opens the official network app directly, or prompts you to download it from the App Store or Google Play
• The branding matches what you'd see if you searched the payment network's name directly

Red flags on a phishing page:

• A generic or lookalike domain — vend-pay.com, cantaloupe-payment.net, or anything that isn't the exact official domain
• A card form that asks for your full card number, expiration, and CVV with no machine ID or account context
• Slightly off branding — compressed logos, wrong colors, mismatched fonts
• An APK download link or any prompt to install a file outside the App Store or Google Play

If you're unsure, don't enter anything. Pay with cash or a tap-to-pay card at the machine's physical terminal instead.

What to do right now

If you only scanned and didn't enter any information: Your risk is low. Close the page and don't return to it.

If you entered your card details, act immediately:

1. Call your card issuer now. Use the number on the back of your card — not a number from any page you visited. Report the card as potentially compromised and ask them to freeze it and send a replacement.
2. Watch for small test charges. Attackers often run a $0–$1 authorization to verify the card works before selling it or making larger purchases. Report any unrecognized charge, even tiny ones.
3. Report to the building or vending operator. Tell the office manager, school staff, or facility where the machine is located. They can contact the vending company to inspect and re-secure the machine before the next person is affected.
4. File a report with the FTC at reportfraud.ftc.gov. Your report contributes to enforcement actions and helps the FTC track emerging fraud patterns.

For a full walkthrough of what to do after any suspicious QR scan, see what to do if you scanned a suspicious QR code. For detailed guidance on card compromise, see QR code credit card scam: what happens and what to do.

Frequently asked questions