QR Code Hijacking at the Detroit Auto Show: What You Need to Know
The Detroit Auto Show brings thousands of visitors together to see the latest vehicles and innovations. QR codes are everywhere at events like this, on signage, displays, promotional materials, and product information stands. They are convenient. They are also a target. Michigan Attorney General Dana Nessel has issued a warning about QR Code Hijacking, urging Auto Show attendees to stay alert before they scan.
What Is QR Code Hijacking?
A QR code is a square barcode that your smartphone camera can read instantly, directing you to a website, app, form, or payment page. They are used everywhere from restaurant menus to event tickets precisely because they are fast and require no typing.
Cybercriminals exploit that convenience by placing fake QR codes (QR Code Hijacking) over legitimate ones, usually using stickers that are difficult to distinguish from the original at a glance. When you scan the hijacked code, it redirects you to a phishing website designed to steal your login credentials, personal information, or payment details. You think you are signing up for a car giveaway or accessing vehicle specs. You are actually handing your data to a scammer.
How to Stay Safe When Scanning QR Codes
Inspect the Code Before You Scan
Look at the QR code itself before you point your camera at it. Does it sit flat and flush with the surface it is on, or does it look raised, like a sticker applied on top? Is there any sign of tampering at the edges? A legitimate QR code printed directly on official signage will not have visible sticker edges or bubbling. If something looks off, do not scan it.
Verify the Source
Only scan QR codes from verified official event materials or displays you have confirmed are from an established brand or organization. Codes posted on pillars, temporary stands, or in high-traffic walking areas are easier for scammers to tamper with because there is less oversight. When in doubt, search for the company’s official website directly rather than scanning.
Check the URL Before You Proceed
When you scan a QR code, your phone shows you the URL before it opens the page. Look at it carefully. Does it match the official domain of the brand or event? An extra word, a hyphen, or a different domain extension like .net instead of .com is a warning sign. Close it immediately if the URL looks wrong and do not enter any information.
Never Enter Financial Information After Scanning an Unknown Code
No legitimate Auto Show promotion will require you to enter your credit card number, bank account information, or Social Security number after scanning a QR code. If a page asks for that information, close it and report the code to event staff immediately.
What to Do If You Were Targeted
If you scanned a suspicious QR code and entered personal or financial information, act immediately.
Report the incident to your local FBI field office and file a complaint with the FBI Internet Crime Complaint Center at ic3.gov.
For consumer-related scams in Michigan, contact the Attorney General’s Consumer Protection Team:
Phone: 877-765-8388
Online: Submit a Complaint
Mail: P.O. Box 30213, Lansing, MI 48909
If your PDCU account information was compromised, call us immediately at 844-700-7328 during business hours. To report a lost or stolen debit card any time call 888-241-2510, available 24 hours a day.
For more information on how to protect yourself and your personal information, visit our fraud alerts page.
QR Code Hijacking
Scanned Something Suspicious? Act Before It Costs You.
QR code scams move fast. The sooner you act the better your chances of limiting the damage. Here are three steps to take right now.
Call PDCU Right Away
If you entered your PDCU account information or card details on a suspicious site, call us at 844-700-7328 during business hours. To report a lost or stolen debit card any time call 888-241-2510. Available 24 hours a day.
Set Up Fraud Alerts
PDCU fraud alerts notify you the moment suspicious activity hits your account. Set them up before your next event so you know immediately if someone attempts an unauthorized transaction on your accounts.
Bank Securely From Your Phone
The safest way to access your PDCU accounts at events is through the official MyPDCU app on your mobile data. No public Wi-Fi. No suspicious QR codes. Just secure banking from wherever you are.
People Driven Credit Union will never ask for your password, PIN, or one-time passcode by phone, text, email, or QR code. To report a lost or stolen debit card any time call 888-241-2510. To report internet crime visit ic3.gov. Federally insured by the NCUA. NMLS #776727. QR Code Hijacking
Meet the Author: John Scharff
John Scharff is the Digital Marketing Lead at People Driven Credit Union, where he helps create clear, practical financial content for members and the communities PDCU serves. He focuses on making financial topics easier to understand, from loans and savings accounts to digital banking, fraud prevention, and everyday money management.
View More Posts
