Pretexting & Impersonation Documented incident

PG&E Scam (2026): Fake Shutoff Calls That End With a Barcode at the Checkout

In the PG&E scam, a caller claiming to be from the utility threatens to cut the power today. Then a barcode or QR code arrives by text or email, with orders to pay it at a store checkout. By the middle of 2026, PG&E customers had reported more than $211,000 in losses, and the company suspects the barcode trick is part of why.

Social Engineering Examples·4 sources

Key takeaways

PG&E's most common scam script hasn't changed. Your bill's overdue, says the caller, and the power goes off today. The twist is the payment. Victims get sent to a store with a barcode or QR code on their phone, and a cashier scans it.
In the first half of 2026 alone, customers reported more than $211,000 in losses. The whole of 2025 came to over $301,000. Meanwhile the average loss went from $590 to $969.
Businesses are hit too. Business customers had filed nearly 656 reports by mid-2026. There were 846 in all of 2025.
PG&E won't ever take payment by barcode, QR code, prepaid card, gift card, cryptocurrency, Zelle, or Venmo. A caller who asks for any of them is running the PG&E scam.

What PG&E reported in June 2026

PG&E went public with the barcode warning on June 15, 2026, in a press release that quoted its lead scam investigator. Every figure below is PG&E's own tally of losses that customers chose to report. The company says plenty of people never report, so treat these numbers as a floor.

Measure	2025 (full year)	2026 (through mid-year)
Reported losses	Over $301,000	Over $211,000
Average reported loss	$590	$969
Customer scam reports	Nearly 24,000	Not stated
Reports from business customers	846	Nearly 656

According to PG&E, the barcode variant "may be playing a part" in the 2026 rise. The data can't tell you much more than that. Barcode payments sit in the same totals as gift cards, prepaid cards, and app transfers. So what the numbers really show is utility-scam losses going up. They do not show that barcodes cost each victim more.

How the PG&E scam works, step by step

Pretext. It opens with a phone call from "PG&E" about an overdue account. That is pretexting in its plainest form: a borrowed identity plus a reason to hurry.
Initial contact. Small businesses often hear from the caller at their busiest hour, when shutting the doors for even an afternoon would hurt. PG&E warns that the number on screen can look like a genuine 800 line. It is the same caller-ID spoofing that iSpoof sold to fraudsters.
Pressure. Pay now, the caller says, or the power goes off, sometimes within the hour. Manufactured urgency like this sits at the heart of vishing.
Payload delivery. A barcode or QR code follows by text or email. Since the con begins on the phone, this is a voice scam with a QR-code payment step, not a QR-code lure.
Cash-out. The victim takes the code to a store and a cashier scans it. Local reporting says the scammer can pull the money out almost immediately.

Why a store cashier is part of the scam

Other versions of the PG&E scam ask for prepaid cards such as Green Dot or MoneyPak. The Napa County District Attorney's office has described that variant, right down to caller ID reading "PG&E."

With a barcode, the payment runs through an ordinary store checkout instead. A PG&E spokesperson told The Press Democrat that the cashier scanning it may not know to warn the customer. That is a point about the person at the till. It does not prove that barcode payment systems have no fraud checks.

For defenders, the checkout matters for one reason. It is the last moment when someone other than the victim sees the payment happen.

The same pretext at Southern California Edison

The PG&E warning reads a lot like Southern California Edison's 2025 disconnection-threat scam report. The two companies don't count the same things, so read the numbers side by side and leave it at that. Add them up and you'd get a number that means nothing.

	PG&E	Southern California Edison
Period	2025 and the first half of 2026	2025, against a 2024 baseline
Headline figure	Over $301,000 lost in 2025; over $211,000 by mid-2026	$131,464 collected by scammers in 2025
What is counted	Customer-reported losses	Amounts collected across 1,750 customer fraud complaints
Threats described	Immediate disconnection, then a barcode or QR code to pay at a store	Immediate disconnection and meter removal
Disclosed	Press release, June 15, 2026	Company report, March 2, 2026

Neither utility pins its whole total on one method. Both publish customer reports in aggregate, which is why nobody outside PG&E knows what share of its losses came from barcodes.

Red flags in PG&E scam calls

PG&E's own scam page quotes the script. The caller says the bill is past due, then adds: "Your power will be shut off within the hour unless you make an immediate payment." Every piece of that sentence is a warning sign.

What the caller does	Why it is a red flag
Threatens shutoff within the hour	A real past-due account gets a disconnection notice in advance, usually by mail and with the monthly bill.
Demands payment on this call	PG&E says it will never send a single notification within one hour of a service interruption.
Sends a barcode or QR code to pay at a store	Real PG&E staff will not ask you to pay with a barcode or QR code.
Asks for a prepaid card, gift card, crypto, Zelle, or Venmo	PG&E does not accept any of these.
Shows a PG&E number on caller ID	Caller ID is easy to fake. Ring that number back and you may not reach PG&E at all.
Calls a business at its busiest hour	That's on purpose. A busy owner is more likely to pay than risk closing.

PG&E barcode scam timeline

Date	Event	Source
2025	Customers file nearly 24,000 reports of PG&E impersonation and lose over $301,000.	PG&E press release
June 15, 2026	PG&E warns of the emerging barcode scam and reports over $211,000 in losses through mid-year.	PG&E press release
June 23, 2026	NBC Bay Area reports the scam; San Jose police say they are aware of it and investigating.	NBC Bay Area
July 2, 2026	The Press Democrat reports 144 targeted customers in Sonoma County and 21 in Napa County in the first half of 2026.	The Press Democrat

None of the sources reviewed for this page names a suspect or mentions an arrest. PG&E is describing a fraud pattern that's still going, not one case that went to court.

What would have stopped it, for each audience

Households

Hang up on anyone who threatens a same-day shutoff. Then check the account yourself, either at PGE.com or on the number printed on your bill. Whatever number the caller offers, don't use it.

Small-business owners

Decide ahead of time that nobody pays a utility because a caller demands it, however hectic the day. And stick PG&E's scam line, 1-833-500-SCAM, up where every staff member will see it.

Retail cashiers and store managers

Someone paying a "utility bill" with a barcode that came by text could be mid-scam. Staff can ask one short, friendly question at the register. It is the last control in the chain.

Utilities and trainers

Copy PG&E. Publish the script scammers really use and keep repeating the payment methods you never accept. Customers can check a call against a plain "we never do this" in a way they cannot with "be careful."

PG&E scam: common questions

Does PG&E call customers about past-due bills?

Sometimes, yes, for example before a scheduled visit. But PG&E says an overdue account gets a disconnection notice first, usually by mail and along with the monthly bill. It won't threaten to cut you off within the hour, and it won't ask for financial details over the phone. If a call feels off, hang up. Then call PG&E on a number you looked up yourself.

Is the PG&E barcode scam real?

Yes. PG&E announced it on June 15, 2026, calling it a new twist on its most common scam. The caller threatens disconnection, then texts or emails a barcode or QR code and sends the customer to a store to pay. NBC Bay Area and The Press Democrat both covered it that summer.

How much have PG&E scam victims lost?

Customers reported more than $301,000 in losses for 2025 and more than $211,000 for the first half of 2026, according to PG&E. Those totals include every kind of PG&E impersonation, not just barcodes. PG&E adds that many scams go unreported, so actual losses are probably higher.

How do I report a PG&E scam call?

Use PG&E's telephone scam report form for calls, forward scam emails to ScamReporting@pge.com, and call 1-833-500-SCAM about anyone who turns up in person. If you paid or gave out card or bank details, tell your bank and local police as well. Call 911 if someone at the door feels threatening.

Reviewed by SEE Team. Last reviewed: 2026-10-19. Read how cases are sourced and checked in our methodology, or learn who publishes this library.

Sources

PG&E Warns Customers About Emerging "Barcode Scam:" Here's What You Should Know. PG&E Corporation (primary). Official June 15, 2026 press release; source of the $211,000 H1-2026 loss figure, $969 average loss, 2025 comparison figures, and quotes from lead scam investigator Matt Foley.
Scams | PG&E. PG&E (primary). PG&E's standing consumer-facing scam-awareness and reporting page, including the 1-833-500-SCAM line and guidance never to pay via barcode/QR code, gift card, or money-transfer app.
'Barcode scam' has cost PG&E customers $211,000 so far this year, utility says. The Press Democrat (secondary). July 2, 2026 report with regional breakdown (Sonoma County 144, Napa County 21) and PG&E spokesperson Jason King's explanation of why cashier-scanned barcodes lack fraud warnings.
PG&E warns of new scam involving bar codes or QR codes. NBC Bay Area (secondary). June 23, 2026 secondary coverage.

Cite this case

Social Engineering Examples. “PG&E Scam (2026): Fake Shutoff Calls That End With a Barcode at the Checkout”. Accessed 3 November 2026. https://socialengineeringexamples.com/pge-barcode-qr-utility-shutoff-scam-2026

Attack Chain & Defense

1List and contact acquisition

What happened

Scammers typically work from broad, low-cost lead sources rather than individually researched targets, consistent with the mass, opportunistic targeting PG&E describes; likely inputs include leaked or scraped consumer contact lists, publicly available residential and business phone directories, and simple knowledge that a target lives or operates within a large utility's service territory, since no specific account data appears necessary to run the pretext convincingly.