Walmart QR Code Scam: What to Know and What to Do
You scanned a QR code at Walmart — or got a text saying you won a Walmart gift card — and now something doesn't feel right. Here's how the three most common Walmart QR code scams work, how to tell a real Walmart code from a fake one, and what to do if your information or money was compromised.
The three Walmart QR code scams to know
1. Self-checkout terminal sticker swaps
Scammers print small QR code stickers and place them directly over the legitimate payment QR codes on Walmart self-checkout terminals. When you scan what you believe is the store's payment code, you're actually scanning the attacker's code — which routes you to a lookalike payment page that captures your card number, expiration date, and CVV. Because self-checkout areas are busy and unsupervised, tampered stickers can go unnoticed for hours.
The clearest red flag: Walmart's self-checkout payment flow runs entirely on the terminal screen and the official Walmart app. You should never be directed to an external website to complete a payment.
2. Fake prize and survey scams
A text message, email, or social media post arrives claiming you've been selected to receive a Walmart gift card — all you have to do is scan the QR code to claim it. The QR code leads to a convincing Walmart-branded survey page that asks for personal information and, eventually, a small "shipping fee" paid by credit card. No gift card ever arrives. Variants of this scam are among the most reported QR phishing attacks in the United States; see the fake giveaway QR code scam page for the full breakdown.
Walmart does run legitimate sweepstakes, but winners are notified through official Walmart.com channels — not unsolicited texts with QR codes.
3. Receipt QR codes redirecting to phishing sites
Real Walmart receipts include QR codes for customer-satisfaction surveys and Walmart.com account links. Scammers exploit this expectation in two ways: by printing fake receipts that mimic the real ones, or by placing stickers with malicious QR codes on receipts in high-turnover areas like self-checkout bag dispensers. Scanning the code takes you to a fake survey page that harvests login credentials or card details under the promise of a coupon or discount.
Legitimate Walmart survey URLs resolve to walmart.com or a clearly affiliated domain. If the QR code from your receipt opens any other domain, close the browser immediately without entering anything.
Walmart Scan & Go vs. a scam: how to tell them apart
Walmart's legitimate Scan & Go feature lives entirely inside the official Walmart app. You scan item barcodes with your phone camera as you shop, then show a QR code generated by the app to the attendant at self-checkout exit. At no point does Walmart ask you to scan a QR code from an external sticker, email, or text message to use Scan & Go.
If you see a QR code sticker on a self-checkout terminal, a bag carousel, or any in-store signage that asks you to scan to pay or to "activate" Scan & Go, treat it as a potential scam. Report it to a Walmart employee before leaving.
What to do right now
- Call your bank or card issuer immediately. If you entered payment information, report the transaction as fraudulent and ask for the card to be frozen and replaced. Credit card disputes are governed by the Fair Credit Billing Act; debit cards have slightly shorter dispute windows, so act within 60 days.
- Change any compromised passwords. If you entered a Walmart.com login, change your password and your Walmart account email password. Enable two-factor authentication on both.
- Alert the store. If the tampered QR code was on an in-store device, tell a Walmart employee or manager. They can inspect the terminal and notify loss prevention to protect other customers.
- File an FTC complaint. Report the scam at reportfraud.ftc.gov. Include any screenshots of the QR code, the fake page, and any messages you received.
- Report to the FBI's IC3. If the loss was significant, file at ic3.gov. Walmart QR scams are prosecuted as wire fraud.
How to protect yourself going forward
- Inspect stickers before scanning. Look for a raised edge, slightly different color, or misalignment — signs that a sticker has been placed over an original code on a terminal or signage.
- Check the URL before acting. After scanning, preview the destination in QRsafer before you tap "open." Legitimate Walmart codes resolve to walmart.com. Any other domain is a red flag.
- Never pay via a QR code outside the Walmart app. If a self-checkout screen, flyer, or receipt QR code sends you to an external payment page, stop and pay through the terminal keypad or the official Walmart app instead.
- Treat unsolicited prize texts as scams by default. Walmart does not notify winners by text with a QR code. See also: fake coupon and discount QR code scams.
Frequently asked questions
Can I get my money back if I paid through a fake Walmart QR code?
It depends on how you paid. Credit card payments have the strongest dispute rights under the Fair Credit Billing Act — contact your card issuer immediately and report the charge as fraudulent. Debit card payments are slightly harder to recover but still disputable; call your bank within 60 days. Payments made via peer-to-peer apps like Venmo or Cash App are the hardest to reverse. In all cases, report the scam to the FTC at reportfraud.ftc.gov and to Walmart Customer Care.
Is the QR code on a Walmart receipt safe to scan?
Legitimate Walmart receipts include QR codes for customer surveys and Walmart.com links. However, scammers have been known to print and place fake receipts — or overlay stickers on real ones — with QR codes pointing to phishing pages. Before scanning any receipt QR code, use QRsafer to preview the destination URL. A safe code will resolve to a walmart.com domain, not a third-party site.
How does Walmart Scan & Go actually work, and how is it different from a scam?
Walmart Scan & Go is a feature inside the official Walmart app that lets you scan items with your phone as you shop. The QR code shown at checkout is generated by your own app and displayed on your screen — you are never asked to scan a sticker on equipment or in an email to use it. If anyone asks you to scan an external QR code to "activate Scan & Go" or "complete your purchase," that is not a legitimate Walmart process.
What should I do if I entered my payment info after scanning a suspicious Walmart QR code?
Act immediately: (1) Call your bank or card issuer to report the unauthorized charge and freeze or replace the card. (2) Change the password for any account whose credentials you entered. (3) Enable two-factor authentication on your email and financial accounts. (4) File a complaint at reportfraud.ftc.gov and with your state attorney general. (5) If the scam involved a physical Walmart location, report it to the store manager so the tampered device or sticker can be removed.
Check the QR code before you scan
QRsafer previews any QR code destination and tells you if it's safe — before you open it or enter a single character. Free on iOS and Android.