QR Code and Text Gift Card Scams (2026)
Why the gift card is always the ask
Quishing (a malicious QR code) and smishing (a scam text) are two front doors to the same old con. The message invents a crisis, a fee, or a prize, then steers you toward a gift card. The rule that beats all of it: nobody legitimate, ever, will ask you to pay a bill, a fine, or a fee with a gift card. If someone who contacted you first wants gift-card numbers, it is a scam. Full stop.
Follow enough of these scams and you notice they all end in the same room: a drugstore or a grocery aisle, somebody standing in front of a wall of plastic cards, reading the digits off the back into a phone. The story that got them there changes. The destination does not.
Gift cards are the con artist’s favorite because they behave like cash and travel like email. Once someone reads you the code off the back of an Apple Gift Card or a Google Play card, the money is gone and it is anonymous. There is no account to freeze, no chargeback, no bank to call and plead with. We say this plainly because the whole swindle depends on you not knowing it: a gift card is a store voucher, not a way to pay a toll, a tax bill, a utility, or a fine. The moment a stranger insists it is, you are being robbed.
Quishing: the QR code is the bait now
Quishing is phishing wearing a QR code. The square is doing one job, which is to hide the web address underneath it. You cannot read a QR code with your eyes, so you cannot see that the link goes to a counterfeit page instead of the real one. That is the entire trick.
The FTC has flagged the physical version of this: scammers print their own QR stickers and slap them over the real ones. Parking meters, public chargers, the little placard on a restaurant table. You scan what looks like the official code, land on a page that apes the real brand, and type in a card number or a login. The FBI has warned about the same move on tampered codes in public places.
The digital version arrives in your inbox or your texts. A QR code for a package you did not order, a payment you need to confirm, an account you must verify. We treat an unexpected QR code the way we treat an unexpected check in the mail. Pleasant surprise, almost certainly fake. If you actually need to reach a company, type the address yourself or open the app you already have. Do not let a pixel square choose the destination for you.
Smishing: the fake text with a deadline
Smishing is the text-message cousin, and it has gotten good. The template is reliable: a short message, a manufactured emergency, and a link. A delivery from USPS or FedEx is stuck and needs a small redelivery fee. An E-ZPass or state toll authority says you owe a few dollars and penalties are mounting. Your bank spotted fraud and you must confirm it now. The dollar amount is always small enough to feel plausible and the clock is always running.
The small fee is not the point. The point is to get you onto a fake page or on the phone with a ‘representative,’ and that is where the ask escalates. Suddenly the only way to resolve it, verify your identity, or release your refund is to go buy gift cards and read off the numbers. The FTC has been blunt that real toll agencies, real delivery carriers, and real government offices do not text you demanding payment by gift card.
Here is the tell that cuts through all of it. Legitimate outfits do not create a payment emergency over text and then route you to a Target or a CVS gift-card rack. Urgency plus a link plus an eventual gift-card request is not three separate red flags. It is one scam with three moving parts.
I followed one of these texts as far as was safe
I got the toll one on a Tuesday. ‘Your vehicle has an unpaid toll of $6.99. Pay now to avoid a late fee.’ I have driven through exactly zero toll gantries lately, which is the only reason I looked twice instead of tapping on reflex. The number was a long string I did not recognize and the link was a jumble of characters pretending to be an official domain.
I opened the page on a locked-down device, the way you might poke a dead wasp with a stick. It was a competent fake. The right shade of blue, a logo, a form asking for my card details to settle the $6.99. I did not type anything, because the whole architecture only works if you do. Later, out of curiosity, I played the other version, the one where you call a number. A calm voice told me there was a ‘processing hold’ and that the fastest fix was to buy a couple of gift cards and read him the codes so he could ‘verify the account.’ There it was. Six dollars and ninety-nine cents of bait, and a few hundred dollars of hook.
The lesson was not that the scam was clever. It was that it only needed me to be busy and slightly worried for about forty seconds. That is the entire budget these things run on.
What to do, and what to never do
Never do these: never scan a QR code you did not expect, never tap a link in an unexpected text, and never, under any story, buy a gift card to pay a fee, a fine, a toll, a tax, or to ‘verify’ anything for someone who contacted you first. No real refund, prize, or account fix has ever required a Walmart gift card. If the payment method is a gift card, the payee is a thief.
Do these instead: when a message claims to be from a company or an agency, ignore its link entirely and reach them through a channel you already trust. Open the carrier’s app. Type the toll authority’s real address yourself. Call the bank number printed on your actual card. Check whether you even have a package coming before you worry about one. If you are ever unsure, slow down, because speed is the only edge the scammer has.
If you already paid, do not go quiet out of embarrassment. Call the gift-card company’s fraud line immediately, since money is occasionally recoverable if you move fast. Then report it to the FTC at reportfraud.ftc.gov and file with the FBI’s Internet Crime Complaint Center at ic3.gov. Your report feeds the warnings that keep the next person from reading their numbers into a stranger’s phone.
Frequently asked questions
What is quishing?
Quishing is phishing that uses a QR code instead of a visible link. Because you cannot read a QR code with your eyes, the square hides where it actually sends you, which is often a counterfeit page built to steal logins, card numbers, or push you toward buying gift cards. Scammers use it in emails, texts, and even as printed stickers placed over real codes in public.
What is smishing?
Smishing is phishing by SMS text message. A short text invents an emergency, a fake delivery problem, an unpaid toll, a bank alert, and includes a link or a number to call. The goal is to rush you onto a fake page or onto the phone with a scammer, who then asks for payment, frequently by gift card. The word is a blend of SMS and phishing.
Why do scammers specifically want gift cards?
Gift cards act like cash and are nearly impossible to trace or reverse. Once you read the code off the back to someone, they can drain it instantly and anonymously, with no bank to call and no chargeback to file. That is exactly why no legitimate company or government agency will ever ask you to pay with one. The payment method itself is the red flag.
Are the fake toll and delivery texts really that common?
Yes. Fake unpaid-toll texts and stuck-package texts have become two of the most widespread smishing templates, and the FTC has issued public warnings about both. They work because almost everyone is either expecting a package or has driven somewhere, so the story feels plausible for a second. That second is all the scam needs.
Is it dangerous to just scan a QR code?
Scanning a code mostly just opens a web address, so the real danger is what you do next on the page it loads. The risk is that you then enter a password, a card number, or payment details on a convincing fake. Treat an unexpected QR code like an unexpected link: do not scan it, and if you did, do not type anything into whatever opens.
How can I tell a scam text from a real one?
Look for the combination of urgency, an unfamiliar link or phone number, and a small-but-specific dollar amount. Real companies usually will not text you a surprise payment demand with a tight deadline. The surest move is to ignore the message’s link entirely and contact the company through its official app or a number you already have, then confirm whether anything is actually wrong.
A message says I owe money or a refund is waiting. Should I act fast?
No. Manufactured urgency is the core of the con, because speed stops you from checking. Slow down and verify through a channel you trust before doing anything. A genuine toll, bill, or refund will still be there in an hour, and no real one requires a gift card to resolve.
I scanned a code or tapped a link but did not enter anything. Am I in trouble?
If you only opened the page and typed nothing, you are very likely fine, since the scam needs your information or your money to work. Close the page, do not enter credentials or card details, and do not call any number it shows you. If you are worried, run a security scan and keep an eye on the accounts that page impersonated.
I already bought gift cards and gave someone the codes. What now?
Act immediately. Call the gift-card issuer’s customer service or fraud line, because funds are occasionally recoverable if the cards have not been fully drained. Then report the scam to the FTC at reportfraud.ftc.gov and file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov. Reporting will not guarantee your money back, but it helps investigators and warns the next target.
The short version
I keep coming back to how cheap these scams are to run. The toll text cost the scammer nothing, and it only needed me to be busy and slightly worried for about forty seconds. So give yourself the forty seconds back. When a text or a QR code invents an emergency and a link, assume it is lying until you have checked through a channel you already trust. And hold onto the one rule that never fails: if the fix for any problem is to go buy a gift card and read the numbers to someone who contacted you first, there is no problem except the person on the other end.