Should You Scan QR Codes In Holiday Flyers?
Type the store address instead of scanning a flyer QR code to check holiday savings safely.
No, do not scan a QR code on a holiday flyer on sight. Quishing, or QR-code phishing, redirects scanners to look-alike sites that steal entered details. North Dakota Information Technology says scammers stick malicious stickers over legitimate store promos, event flyers, and parking-meter codes to send scanners to fake portals, malware, or coupon-phishing pages, according to its holiday-scam guidance.
A flyer on a windshield, bulletin board, or door can carry the same swap.
Verification note: Program terms and availability can change. This page was checked against linked sources on November 03, 2026.
Why flyers are easy to rig
A printed flyer has no lock icon or sender address to check. A sticker or reprint can cover the real code without changing the rest of the design. High-traffic spots make the swap harder to notice during the holidays.
Parking meters show the same trick. People reported scammers covering real meter codes with stickers that route payment to fake sites built to take money and personal data. A holiday market, concert wall, or store window works the same way.
What a bad scan can cost you
The Federal Trade Commission warns that a scammer's code can take you to a spoofed site that looks real to steal login or payment details entered there, or install malware that steals information, as explained in its QR-code warning. One entry on a fake coupon or delivery form can expose a card, password, or address. Unexpected gifts add another path.
The Postal Inspection Service's holiday Cut Out Crime campaign warns that unexpected gifts with QR codes are quishing lures and tells recipients not to scan them because linked sites harvest personal and financial information, described in its holiday warnings. The same caution fits unordered parcels that ask you to scan to find the sender or start a return.
How to check the deal without scanning
Treat the flyer as a tip, not a link. Note the store name, product, dates, and any code printed in plain text. Then look up the deal through the merchant's own app or by typing the store address yourself.
If you still consider the code, pause at the preview screen: Previews help, but they cannot prove safety because domains can be spoofed.
- Preview the URL before tapping and look for a mismatch or shortened domain.
- Reject pages that demand a login or payment for a flyer coupon.
- Close the preview and check the same deal in the merchant app or typed address.
What to do with a suspicious flyer or package
Do not enter details, download a file, or connect a payment wallet from the linked page. Close the page, keep the flyer or box, and write down where and when you got it. That record helps if money moves or messages follow.
Report the attempt through ReportFraud.ftc.gov and BBB Scam Tracker, and use the merchant's own contact to ask whether the promo is current, following federal reporting guidance. Send the flyer details to ReportFraud.ftc.gov instead of scanning the code again.