How to Find Who’s Behind a QR-Code Scam

A QR code is just a machine-readable address. The square of dots encodes a web link, and your phone opens it the instant you scan, with no chance to read the destination the way you would skim a printed link. That blind spot is the entire scam. In a quishing attack, a criminal replaces or plants a code that points to a clone of a site you trust, then lets your own habits do the rest. You scanned a parking code, so you expect a parking-payment page. You scanned a menu, so you expect to order food. The page that loads looks right, the logo is right, and you type in your card or your password without a second thought. Everything you enter is captured in real time on a server the scammer controls.

The most common version is the sticker swap. Scammers print a durable, weather-resistant sticker carrying their own QR code and paste it directly over the genuine code on a parking meter or pay station, often a near-perfect copy of the city portal or a service like ParkMobile. Consumer reporting has documented these sticker scams on metered parking in Cherry Creek in Denver and across parts of Southern California, and they spread to anywhere people scan to pay. A close cousin shows up on restaurant table tents and menus, redirecting diners to a fake ordering or payment page. The third major variant arrives in your mailbox: a letter or an unsolicited package with a QR code and a reason to scan it, such as a supposed unpaid toll, a tax notice, or a teaser to find out who sent you a gift. Because the page never reveals itself until you have already scanned, the same lawful research used to investigate fraud of any kind starts with one question: where did that code really point, and who registered it?

The clone domain and the parking-meter sticker are both designed to be temporary. Hosts take down reported phishing pages, scammers rotate to fresh look-alike domains, and a city worker may peel the fake sticker off by the next morning. So the first job is to lock down your accounts and capture proof in the same hour. The FTC’s consumer guidance is blunt that scammers hide harmful links inside QR codes to steal card numbers and login credentials, which tells you exactly what to assume was taken and what to protect first. You can read that guidance directly at the FTC consumer site.

The digital trail. A QR code may be anonymous, but the destination is not built from nothing. The clone lives on a registered domain, sits on a hosting account, and routes payments through a processor or merchant account. The look-alike domain has a registration record, a creation date, name servers, and frequently a contact email or a re-used registrant detail that ties it to other fraudulent sites built by the same crew. The same email, handle, or hosting fingerprint behind one parking clone often turns up behind a whole batch of them. Documenting the exact address, the domain, the page, and the payment descriptor is what turns a vague “I got scammed” into a record investigators can correlate. Our role on this side is supportive: organizing the domain, the link, and the timeline into a usable trail, the same way we approach tracing a contact in our guide on how to find someone by an email address when a registrant or contact email is in hand.

The human trail. This is the lane the prevention articles never touch, and it is where our investigation team fits. Behind the clone domain and the payment page are real people with real footprints: the person who registered the look-alike domain, the operator of the merchant account that ran your card, and above all the money mule whose bank account or processor balance received the funds. Those identifiers, even when names on a page are fake, can be researched lawfully through public records and skip-tracing techniques to surface a real name, address, and associates. That is the same work behind our guides on how to find someone who scammed you and how to identify a scammer by a phone number when the scam included a call-back or text. A named, located individual changes everything: it strengthens your FTC and IC3 reports, gives a prosecutor or an attorney something concrete, and opens the door to a civil claim that a screenshot of a fake page alone cannot support.

QR codes are everywhere now, which is exactly why they work as bait, and some people are more exposed than others. An older relative who pays for parking by phone, a small-business owner who lets customers scan a code at the counter, or anyone in the habit of scanning first and reading later is a natural target. If someone close to you was hit, lead with help, not blame, because shame is what keeps victims quiet and lets the same operation keep running. Walk through the simple habits that defeat quishing: check whether a code is a sticker layered over another surface, read the web address before entering anything, and never scan a code that arrived by mail or in a package you did not expect. Encourage paying at parking meters and stations by their printed app name or short code rather than a pasted QR, and steer them to the official warnings published by the FTC and the U.S. Postal Inspection Service so the message is not coming from you alone. For a small business, fixing this is also a duty of care, since a sticker slapped over the code at your own register turns your customers into victims and your storefront into the crime scene.

Quishing runs on the same rails as other online fraud, so the people behind it surface through the same lawful research that powers our full-spectrum skip tracing work. Send us what you have, even if it feels like nothing: the look-alike web address, a screenshot of the clone page, the payment descriptor from your statement, an email or phone number the code arrived with, or a name that appeared anywhere in the exchange. We work strictly for lawful, permissible purposes, we never promise a recovery we cannot control, and we tell you honestly what the records can and cannot show. For a legitimate matter, an initial locate typically comes back within 24 hours.