What Is Quishing? How QR Code Scams Work and How to Avoid Them

In short, the danger sits in the address behind the code, not in the code itself. We are Talha Aslan and team, and in this guide we look at both sides: the person who scans the code and the business that prints it. If you want to make your own code safely, try our free QR code generator. It builds the code entirely in your browser, so the data you type never reaches a server.

The word quishing blends "QR" and "phishing." Phishing is the general name for attacks that imitate a brand you trust to collect your details on a fake page. In a QR code scam, the code simply carries the link. That is why most classic phishing advice still applies here. The only twist is that you see black and white squares instead of a readable address.

How does a fake QR code attack unfold, step by step?

A QR code is a two dimensional barcode that stores text as a pattern of squares. Most of the time, that text is a web address. Your phone camera decodes the pattern and offers to open the address. The international standard ISO/IEC 18004 describes the technical structure, and Denso Wave, the company behind the format, explains its error correction levels on its official site.

However, the standard only defines how a reader decodes the pattern. It says nothing about where the code leads. In other words, a valid QR code and a safe QR code are two different things. A typical attack follows this pattern:

1. The attacker builds a fake page that imitates a brand or agency you know.
2. Next, they turn the address of that page into a QR code.
3. They print the code on a sticker, paste it into an email, or slip it into a letter.
4. You scan the code, land on the fake page, and type your details.
5. Finally, the attacker uses those details to take over an account or redirect a payment.

Sometimes the page asks you to install an app or download a file instead. The Canadian Centre for Cyber Security covers this in its security guidance for QR codes. It describes cloned codes that replace a genuine one and lead to a malicious site or install malware. Attackers also lean on urgency. For example, lines like "your fine will increase" or "your account will close today" push you to act before you think.

Why do scammers use QR codes instead of plain links?

The UK National Cyber Security Centre (NCSC) lists three reasons in its post on the real risk of QR codes:

• People have learned to distrust odd links and shortened URLs. A QR code hides the address completely.
• Not every email security tool scans images. Because the code is a picture, it can slip past a filter.
• You usually scan with a personal phone. That phone may lack the protections of a work computer.

Germany's Federal Office for Information Security (BSI) makes a similar point on its phishing advice page. According to the BSI, virus scanners treat QR codes as harmless images, so they miss scams that hide inside them.

Put simply, a QR code hides the address from you and from the filter at the same time. On top of that, a small phone screen makes it harder to read the address bar carefully. The attacker combines both gaps. You reach the page without reading the address, and a familiar logo does the rest.

That combination explains why this kind of scam keeps working even on careful people. It does not rely on a technical flaw in your phone. Instead, it relies on a habit: we scan codes quickly because they usually work and usually lead somewhere useful.

What does a parking meter QR code scam look like?

Example scenario: a pay station in an open car park carries a sticker that says "Scan to pay fast." Someone has placed a second sticker of the same size on top of the real code. A driver scans it, lands on a page that resembles the city's payment site, and enters card details. Then a "payment successful" style message appears, but the card data goes to the attacker.

According to the NCSC, most QR code fraud happens in open spaces such as stations and car parks. It also notes that these scams often pair with social engineering. For example, someone posing as bank staff may call you afterward. The BSI has also warned about payment codes that criminals covered up on parking machines.

On any physical code, watch for these signs:

• The code looks like a sticker someone added later, with raised or crooked edges.
• There are two codes on the same surface, or one code sits on top of another.
• The label does not match the color or font of the rest of the machine.
• The machine accepts cards or an official app, yet the code pushes you down a different path.

If anything looks off, do not scan it. Instead, use the machine's own payment option, the operator's official app, or the address printed on the official sign, typed by hand. After that, report the sticker to the operator so the next driver stays safe.

Are restaurant menu QR codes safe to scan?

Most of the time, yes. The NCSC says QR codes in pubs and restaurants are probably safe to scan. There is a sensible reason: the business controls the code, and staff are around all day. Still, if the code on your table is a sticker and another code sits next to it, ask a staff member.

The Canadian Centre for Cyber Security gives the same advice for labels that could cover another code. It suggests asking staff to confirm before you scan, since the business may simply have updated its code. After all, asking takes a few seconds. Also, for something as simple as a menu, typing the address yourself removes the risk completely.

Example scenario: you scan the menu code, but instead of a menu you see a page that says "Sign in with your email account for free Wi-Fi." No menu ever needs your email password. So that request alone is a red flag. Close the page and tell the staff.

If you run a restaurant, we compared both options in our post on choosing between a restaurant mobile app or a QR menu. Whichever you choose, a menu page on your own domain builds more trust than a page on a stranger's address.

Why are QR codes in emails the riskiest kind?

The NCSC asks you to stay cautious with QR codes in emails and notes a rise in quishing attacks. The BSI is even more direct. Do not scan QR codes in emails that claim to come from a bank or an agency, no matter how genuine they look. Instead, contact the organization through another channel, such as a phone number you already know.

Example scenario: an email arrives with the subject line "Your two step verification expires today." It carries the company logo, no clickable links, and a single QR code. When you scan it with your phone, a copy of the company login page opens and asks for your password.

The subtle part is this. You open the email on a computer, but you scan the code with a phone. As a result, the risky step moves to a device that your company security tools may not watch. Also, because the email contains no clickable link, the filter may see nothing suspicious.

We broke down the general pattern of fake warning emails in our guide to the fake Meta copyright violation message. To make spoofing of your own domain harder, read our guide on how to set up SPF, DKIM, and DMARC. These records do not stop every fake email. However, they help receiving servers tell your real mail from imitations.

Can you trust QR codes in letters, packages, and texts?

Treat any code you did not expect as untrusted by default. In its consumer alerts, the US Federal Trade Commission (FTC) warns about QR codes on notes that arrive with packages you never ordered. It also warns about texts that ask you to pay a traffic fine through a QR code. Printed letters that look like they come from a bank can follow the same playbook.

What these channels share, however, is that the code comes to you. You did not search for anything; the code found you. On top of that, a printed letter feels more official than an email. That feeling is also exactly what the attacker wants.

Ask yourself three questions:

• Was I expecting this message, letter, or package?
• Does the code push me to pay, sign in, or install an app?
• Could I do the same thing through the official app or an address I already know?

If even one answer raises doubt, skip the code. Then check whether the organization really needs something from you by using its known phone number or official app. For example, if a fine notice arrives, type the agency's official website address yourself instead of scanning anything.

QR code scam warning signs by channel

The table below sums up the most common channels and the safer route for each one. Every scenario here is an example scenario; the point is to help you recognize the signs.

The common thread is simple. If a code asks for money, a password, or personal data, choose a route that does not involve the code. That single habit is your strongest protection against any QR code scam.

How can you tell if a QR code is safe before you scan it?

The few seconds before you scan matter more than everything after. The Canadian Centre for Cyber Security advises against scanning codes in public places such as transit stations or street ads. It also advises against scanning codes in emails or texts unless you know the sender is legitimate. Above all, it asks you not to put convenience ahead of security.

Before you scan, run a quick check:

1. Look at the physical state: is it a sticker or a print, and does another code sit underneath?
2. Consider the source: did you expect this code, or did it come to you out of nowhere?
3. Weigh the promise: does the code involve a payment, a login, a gift, or a fine?
4. Notice the pressure: do you see words like "now," "last day," or "account closing"?
5. Look for a way around it: can you do the same thing in the official app or by typing the address?

You also do not need to memorize this list. Once it becomes a habit, it kicks in on its own every time you see a code. Above all, never skip these five steps when money or passwords are involved.

How do you check the link a QR code opens?

Your phone camera usually shows a preview of the address before it opens anything. The FTC also points out that many QR readers preview the link they will send you to. That preview is your most important checkpoint, so read it before you tap.

When you read it, focus on the domain. For example, if the real address is example.com, the domain is the part just before the first single slash, and you read it from right to left. Attackers sometimes place "example.com" at the start of a long address while the real domain sits elsewhere. In other words, spotting "example.com" somewhere in the address is not enough. It has to sit in the right place.

Also keep these points in mind:

• The padlock icon only tells you the connection is encrypted. It does not tell you who owns the page.
• A short link preview shows only the shortening service, not the final destination.
• Lookalike letters can make a fake address pass at a quick glance.

We explain how short links work in our URL shortener comparison. Take browser warnings seriously too. Google Safe Browsing keeps constantly updated lists of phishing and malware sites, and apps can use those lists to warn you. Still, the absence of a warning does not prove a page is safe.

Which QR code scanner should you use?

In practice, the safest choice is usually your phone's own camera or the scanner built into the operating system. The NCSC recommends the built in scanner over third party apps from an app store. The Canadian Centre for Cyber Security also warns against scanner apps from unknown companies.

Why does that matter? A separate scanner app may ask for permissions it does not need to read a code. According to the Canadian guidance, malicious scanner apps can spread malware and reach privacy settings on your device. So a promise of "faster scanning" is not worth installing an unknown app.

You can also tighten a few settings:

• Turn off any option that runs a QR action automatically, and ask for confirmation before each action.
• If a scan opens a suspicious page, close the browser right away.
• Keep automatic updates on for your phone and your browser.

In short, a good scanner shows you the address and leaves the decision to you. If your built in scanner already does that, you do not need an extra app at all.

What should you watch for with Wi-Fi and payment QR codes?

A Wi-Fi QR code carries a network name and password instead of a web address. When you scan it, your phone offers to join that network. That means a fake code could try to connect you to a lookalike network. Before you join, compare the network name with what the staff tell you. After you connect, avoid typing passwords into pages that pop up unexpectedly.

With payment codes, the key checkpoint is the recipient. If your banking app shows the recipient's name or business details before you confirm, read them. For example, if you pay at a cafe but the recipient shows the name of a stranger, stop the payment.

Also be careful when a payment code sends you to a web page instead of your banking app. If you have to type card details into a web form, check the address twice. When in doubt, pay at the counter or through an official app.

These two code types deserve extra care because one touches your network traffic and the other touches your money directly. A few extra seconds here can save you a long cleanup later.

What should you do if you scanned a fake QR code?

Stay calm. Scanning alone often causes no harm. The real question is whether you entered details on the page or downloaded something. Follow this order:

1. Close the page right away and do not fill in any field.
2. If you entered a password, change it through the official app or by typing the address yourself. Then update every other account that uses the same password.
3. If you entered card details, call your bank right away using the number on the back of your card.
4. Turn on two step verification and sign out of any sessions you do not recognize.
5. If you downloaded a file or app, delete it and keep your device updated.
6. Over the next few days, check your account and card activity closely.
7. Report the incident to the police, and if the code was physical, tell the site operator too.

The BSI also tells victims to contact their bank right away and file a police report. What your bank can do depends on the situation, so an early call gives you more options. Nobody can promise a guaranteed recovery, but acting fast limits the damage.

Finally, be wary of strangers who offer to "get your money back" for a fee. Those offers are often a second scam. Do not pay anyone outside official channels.

How can businesses protect their own QR codes from a QR code scam?

When you print a code, you also take responsibility for it. If a customer falls for a fake code, they often blame the place where they saw it, which means you. That is why protection against a QR code scam belongs in the design stage.

These are the core measures our team recommends in client projects:

• Point the code only to an address on your own domain.
• Print the same address as plain text right under the code, so customers can compare it with the preview.
• Where possible, choose direct printing, a spot behind glass, or lamination over loose stickers.
• Adopt a one code per surface rule, so a second code looks suspicious by default.
• Make sure the page behind the code never asks for a password or unnecessary personal data.
• Inspect codes by eye at regular intervals, for example at the start of each shift.

Then consider the hidden side. Even if the code points to the right address, a compromised website can still serve a harmful page. We cover that risk in our guide on what to do when a WordPress site is hacked. Site security and code security are links in the same chain.

How do you notice that someone copied your QR code?

A fake sticker often works quietly. However, some signs give you early notice. For example, if customers start saying "I paid, but it does not show in your system," the code is the first place to look.

Measurement works as an alarm too. If you give each physical location its own address with UTM parameters, your analytics tool shows how often each code gets scanned. If scans at one location suddenly drop to zero, someone may have covered that code. We explain the setup in our guide to UTM parameters.

Example scenario: a cafe chain has five branches, and every table code carries a branch specific UTM tag. Scans look normal at four branches. At the fifth, scans almost vanish within a week. The team checks the tables and finds foreign stickers on top of the original codes at two of them.

This method does not offer proof, because scans can drop for other reasons too. Still, a report you review regularly tells you where to focus your physical checks. If you log customer complaints and staff notes in the same place, the picture becomes clearer.

How do you create a safe QR code, step by step?

A safe code points to the right address, scans easily, and makes any copy easy to spot. Follow these steps:

1. Open the QR code generator and choose Web / URL as the content type.
2. Type the full address on your own domain, for example a short and clear path like https://example.com/menu.
3. Scan the preview with your own phone and check that the address matches what you typed, character for character.
4. If the code will be small or outdoors, set the error correction level to Q or H.
5. Download SVG for print and PNG for screens.
6. Add the same address as plain text under the code, then test it on a few different phones before printing.

According to Denso Wave, level M can restore about 15 percent of the codewords, and level Q about 25 percent. However, error correction only helps with wear and damage. A new sticker on top is an entirely separate code. So never rely on error correction for physical security.

If your code fails on some phones, our guide on a QR code not scanning walks you through the fixes.

Static or dynamic: which QR code is safer?

In a static code, the address lives directly in the pattern. The codes our tool creates are static. They do not depend on a subscription and keep working as long as the address stays live. A dynamic code, by contrast, points to a redirect service, and that service forwards visitors to the final address. That lets you change the destination without reprinting.

However, this convenience has a cost. With a dynamic code, your account at the redirect service becomes a target too. If someone gets into that account, they can change the destination of every printed code at once. Also, if the service shuts down or your subscription ends, your codes may stop working.

We usually suggest a middle path. Point a static code to a short, permanent address on your own domain. For example, an address like example.com/m can forward to a new page on your site whenever you need it. That way you keep flexibility, and you also keep control of the redirect.

Whichever route you take, use strong passwords and two step verification on every admin panel. If you use a dynamic service, limit who can access the account and review destination changes regularly.

How should you brief your team and your customers?

Technical measures only go halfway when people do not know what to look for. So give your staff a short, concrete briefing: where your codes are, what they look like, and which address they open. Also put in writing what they should do when they spot an extra sticker.

For customers, one sentence goes a long way. For instance, a note like "Our code only opens example.com, and we never email you a QR code for payment" helps customers question a fake. Repeat the same note on the menu, at the counter, and on your website.

Team awareness should not stop at QR codes. Fake emails, fake calls, and cloned voices all follow the same social engineering logic. We cover that side for companies in our guide on deepfake and voice cloning fraud.

Finally, if a customer reports a fake code, thank them and check the spot right away. A report like that helps you catch a problem your team could not see.

Common myths about QR code scams

Some ideas we hear often give people false comfort. These are the most common:

• "If there is a padlock, the page is safe." The padlock only shows an encrypted connection, and fake sites can use encryption too.
• "If the code looks clean, it is fine." In fact, a fake code is a technically perfect code. The difference lies in the destination.
• "High error correction makes a code safer." Error correction improves readability. It says nothing about where the code leads.
• "Phones are better protected than computers." As the NCSC notes, personal phones often lack workplace protections.
• "Only careless people fall for it." Hurry, fatigue, and a familiar logo affect everyone. That is why habits beat attention.

Above all, these myths tie trust to how a code looks. Trust actually comes from checking the address and the request. So treat every code like a link: question its source, its destination, and what it asks of you.

Quick checklist: how to avoid a QR code scam

Here is the core of this guide in one list. You can save it in your phone notes or pin it on your staff board:

• Before you scan, check the physical state and the source of the code.
• Read the domain in the preview, and do not rely on the padlock.
• Never pay or sign in through codes in emails, texts, or unexpected deliveries.
• Use your phone's built in scanner and turn off automatic actions.
• If you entered details, change the password, call your bank, and report it.
• If you run a business, point codes to your own domain, print the address underneath, and inspect them regularly.

In the end, a QR code is neither good nor bad; it simply carries an address. With the right habits, you can enjoy that convenience safely, both as a customer and as a business.

Core guide: What Is Digital Marketing? Its types, examples and how it is done, on one page with an interactive film that travels through the brain.