QR codes are everywhere — restaurant menus, parking meters, charity flyers, shop counters, even gravestones. They are convenient because scanning is instant and thoughtless. That thoughtlessness is exactly what scammers exploit. "Quishing" — phishing via QR code — hides malicious links, fake payment requests and credential-stealing pages inside a pattern your eyes cannot read. This guide explains how these scams work and how to defend yourself, every time you scan.
Why QR Codes Are a Perfect Hiding Place
A QR code is a machine-readable link (or text, WiFi credential or payment request) that humans cannot read at a glance. That creates three attacker advantages:
- No preview instinct: with a normal link you can hover or read the domain; with a QR code most people scan first and think later.
- Easy to plant: a scammer only needs a printer. Stickers placed over real QR codes on parking meters, restaurant tables or donation boxes redirect victims silently.
- Email filter evasion: phishing emails increasingly embed QR codes instead of clickable links, because many email security filters inspect text links but not images.
Remember: creating or planting malicious QR codes to deceive people is fraud — illegal everywhere. This guide is purely defensive: how to recognize and avoid these scams, and how security professionals study them with written permission.
The Most Common QR Scam Scenarios
1. Parking meter and EV charger stickers
Scammers place their own QR stickers over legitimate payment codes on parking meters and public chargers. You scan, "pay for parking," and hand your card details to a fake payment page — while your car still gets a ticket. Cities in several countries have reported waves of this exact scam.
2. Fake payment and "refund" codes
A buyer on a marketplace sends you a QR code "to receive your payment" — but the code actually triggers a payment from you, or opens a fake banking login. Legitimate payment apps never ask the recipient to scan a code to receive money from a stranger.
3. Restaurant and event phishing
A QR menu sticker on a table leads to a lookalike page asking you to "log in with Google/Facebook to view the menu." Menus never need your login. The goal is credential theft.
4. QR codes in emails and parcels
Unexpected emails containing QR codes ("verify your package delivery," "claim your refund") bypass link scanners and land on phishing pages. The same trick appears in physical mail and fake delivery notices slipped under doors.
5. Crypto and investment "double your money" codes
Flyers and social posts promise to double any crypto sent to a QR-encoded wallet address. There is no doubling — the address belongs to the scammer and crypto transfers cannot be reversed.
How to Scan QR Codes Safely: 7 Defensive Rules
- Preview before you open. Most phone cameras show the decoded URL before opening it — read it. If your scanner jumps straight to the page, switch to one that previews.
- Check the domain carefully. Look for misspellings, extra words and odd extensions (pay-secure-login-example.com is not your bank). When in doubt, type the real site's address manually instead of scanning.
- Inspect physical codes. If a QR sticker looks pasted over another code, or sits oddly on a parking meter, menu or sign — do not scan it. Use the business's official app or website instead.
- Never scan to "receive" money from strangers. Scanning initiates actions you take — payments, logins, WiFi joins. Receiving money never requires you to scan anything.
- Be suspicious of logins after scanning. A menu, flyer or package tracker has no business asking for your email or social login. Close it and navigate to the official site yourself.
- Analyze suspicious URLs first. If a scanned link looks odd, paste it into our free Phishing URL Analyzer before entering anything — it checks the structure for phishing red flags without you visiting the page.
- Keep your scanner and browser updated. Modern mobile browsers warn about known phishing pages; updates keep those warning lists current.
What To Do If You Already Scanned a Bad Code
- Entered card details? Contact your bank immediately, freeze or replace the card, and watch statements for small test charges — scammers often start tiny.
- Entered a password? Change it right away on the real site (typed manually, not via any link), and change it anywhere else you reused it. Turn on two-factor authentication — see our 2FA guide.
- Downloaded something? Do not open it. Delete the file and run a scan with your phone's built-in security or a reputable antivirus app.
- Report it: tell the business whose QR code was tampered with, and report phishing pages to your email provider and local cybercrime reporting channel.
For the Curious: How Security Professionals Study This
Ethical hackers and security teams study quishing to build defenses — generating test QR codes in a lab, training employees to spot them, and testing whether email filters catch image-based lures. All of this happens with explicit written permission and never against real people or businesses. If you want to explore this field legitimately, start with our penetration testing introduction and the social engineering awareness guide.
The Bottom Line
Treat every QR code like an untrusted link, because that is what it is. Preview the URL, inspect stickers in the physical world, never scan to "receive" money, and never log in through a code you did not expect. Thirty seconds of caution beats weeks of cleaning up identity theft.