QR Code Hijacking at the Detroit Auto Show: What You Need to Know

The Detroit Auto Show brings thousands of visitors together to see the latest vehicles and innovations. QR codes are everywhere at events like this, on signage, displays, promotional materials, and product information stands. They are convenient. They are also a target. Michigan Attorney General Dana Nessel has issued a warning about QR Code Hijacking, urging Auto Show attendees to stay alert before they scan.

What Is QR Code Hijacking?

A QR code is a square barcode that your smartphone camera can read instantly, directing you to a website, app, form, or payment page. They are used everywhere from restaurant menus to event tickets precisely because they are fast and require no typing.

Cybercriminals exploit that convenience by placing fake QR codes (QR Code Hijacking) over legitimate ones, usually using stickers that are difficult to distinguish from the original at a glance. When you scan the hijacked code, it redirects you to a phishing website designed to steal your login credentials, personal information, or payment details. You think you are signing up for a car giveaway or accessing vehicle specs. You are actually handing your data to a scammer.

How to Stay Safe When Scanning QR Codes

Inspect the Code Before You Scan

Look at the QR code itself before you point your camera at it. Does it sit flat and flush with the surface it is on, or does it look raised, like a sticker applied on top? Is there any sign of tampering at the edges? A legitimate QR code printed directly on official signage will not have visible sticker edges or bubbling. If something looks off, do not scan it.

Verify the Source

Only scan QR codes from verified official event materials or displays you have confirmed are from an established brand or organization. Codes posted on pillars, temporary stands, or in high-traffic walking areas are easier for scammers to tamper with because there is less oversight. When in doubt, search for the company’s official website directly rather than scanning.

Check the URL Before You Proceed

When you scan a QR code, your phone shows you the URL before it opens the page. Look at it carefully. Does it match the official domain of the brand or event? An extra word, a hyphen, or a different domain extension like .net instead of .com is a warning sign. Close it immediately if the URL looks wrong and do not enter any information.

Never Enter Financial Information After Scanning an Unknown Code

No legitimate Auto Show promotion will require you to enter your credit card number, bank account information, or Social Security number after scanning a QR code. If a page asks for that information, close it and report the code to event staff immediately.

What to Do If You Were Targeted

If you scanned a suspicious QR code and entered personal or financial information, act immediately.

Report the incident to your local FBI field office and file a complaint with the FBI Internet Crime Complaint Center at ic3.gov.

For consumer-related scams in Michigan, contact the Attorney General’s Consumer Protection Team:

Phone: 877-765-8388
Online: Submit a Complaint
Mail: P.O. Box 30213, Lansing, MI 48909

If your PDCU account information was compromised, call us immediately at 844-700-7328 during business hours. To report a lost or stolen debit card any time call 888-241-2510, available 24 hours a day.

For more information on how to protect yourself and your personal information, visit our fraud alerts page.