QR codes—those small, square patterns you scan with your phone to access websites—have become a convenient tool for everything from restaurant menus to concert tickets. But as QR codes become more common, scammers are exploiting them in sneaky ways.

The scam works like this: a scammer places a fake QR code sticker over a real one in a public place, like a parking meter, event poster, or delivery drop box. When someone scans the code, it redirects them to a phony website that may look official. These bogus sites often ask for personal or payment information, tricking people into handing over credit card numbers, login credentials, or even Social Security numbers.

Sometimes, scanning a malicious QR code can also trigger an automatic app download or a prompt to give permission for things like location tracking or camera access—opening the door to more privacy violations.

To stay safe, only scan QR codes from trusted sources. Double-check the website address before entering any personal info. If a QR code seems out of place—like on a printed sign taped to a gas pump—it’s worth being cautious. And never install apps or software directly from a QR code unless you’re sure it’s legitimate.

QR codes are handy, but like any tech, they’re best used with a healthy dose of caution. If something feels off, it’s better to type in the website manually or contact the organization directly.