QR Code Scams (Quishing): How to Spot a Bad Code

Why scammers use QR codes

The destination is hidden. You cannot see where a code leads by looking at it; you have to rely on the preview your phone shows.
Codes are easy to replace. Codes are printed in public places, and anyone with a sticker can cover a real one.
They slip past email filters. In an email, a QR code is just an image, which link-scanning filters may not check the way they check normal links. Scanning with a phone also moves you away from a work computer and, often, outside your company's security tools.
They feel routine. People use QR codes for menus, parking and tickets every day and scan them without a second thought.

Authorities have noticed. In the United States, the FBI's Internet Crime Complaint Center warned in 2022 about criminals tampering with QR codes to steal money, and the Federal Trade Commission published a consumer alert about QR code scams in 2023. Consumer protection agencies and police in other countries have issued similar warnings.

Where malicious codes show up

Parking meters and charging stations: a sticker over the official code leads to a lookalike payment site.
Fake parking tickets or notices left on a car, with a code for "paying the fine".
Emails and PDF attachments claiming that your password expires, that you must re-register multi-factor authentication, that a document was shared with you or that your payroll details need updating, with a QR code instead of a link.
Delivery notices: texts, letters or cards about a missed parcel.
Unexpected packages with a code that promises to reveal the sender.
Restaurant tables, posters and flyers where the original code has been covered.
Online marketplaces where a "buyer" sends a code that supposedly lets you receive a payment.

What a malicious code can do

A QR code is data, not a program. On a current phone, scanning a code does not install anything or run anything by itself: the camera shows what it found and waits for you to tap. The danger lies in what the code persuades you to do next, such as:

opening a phishing page that asks for a password, card number or one-time code;
downloading an app from outside the official store, or installing a device profile that changes your settings;
joining a Wi-Fi network run by someone else;
starting a call or a pre-written text message, for example to a premium-rate number;
sending money: payment codes for banking apps or cryptocurrency can carry the scammer's account instead of the real one.

That is why the moment between scanning and tapping matters most.

Check the link before you tap

The camera apps on iPhone and Android show the web address, or at least its domain, before opening it. Take a second to read it:

Find the real domain. It is the part just before the first single slash after https://. In https://example.com.account-check.net/login, the site is account-check.net, not example.com.
Look for lookalikes. Watch for misspellings, swapped letters, digits in place of letters and extra words such as "secure", "verify" or "login" added to a familiar brand name.
Be wary of links you cannot read. Short links hide the destination. When money or passwords are involved, do not open one from an unknown source.
Do not trust the padlock. HTTPS only means the connection is encrypted, not that the site is honest. Phishing sites use HTTPS too.
Check that it fits the context. A parking meter should lead to the operator's or city's official site or app, not to an unrelated domain.

Habits that prevent most QR code scams

Pay through official channels. For parking, tolls and charging, use the operator's app or a website you open yourself. If a sign names an app, install it from your app store rather than through the code.
Never sign in after scanning a code from an email. Go to the service by typing its address or using a bookmark. A real IT department can always point you to the portal you already know.
Look at the physical code. Is it a sticker on top of another code? Is an edge peeling, or does it look different from the codes next to it?
Distrust urgency. "Pay within 24 hours" and "your account will be locked" are pressure tactics.
Use a password manager. It fills in passwords only on the exact site they belong to. If it does not offer your password, treat that as a warning sign.
Keep your phone updated, and be careful with Wi-Fi codes in public places: join only networks you expect, and avoid sensitive tasks on unknown ones.

Inspect a QR code without opening it

Sometimes you want to know what a code contains before any phone acts on it, for example a code in an email on your work computer. Our QR code scanner can help:

Take a screenshot of the code, or save the image or photo.
Open the scanner and paste the screenshot with Ctrl+V (⌘V on a Mac), or upload the file.
Read the result. The scanner shows the complete decoded text, labels its type (link, Wi-Fi, contact, email or text) and shows the domain of any link separately. Nothing is opened unless you click it.

Decoding happens in your browser, so the image is not uploaded. The scanner does not judge whether a destination is safe; it shows you what is inside so you can decide. If in doubt, do not open it, and report suspicious emails to your IT team or through your email provider's reporting option.

Advice for businesses that print QR codes

Use your own domain in codes so customers recognize it in the preview, and print the web address next to the code.
Place codes where tampering would be noticed, or behind a protective cover, and check them regularly, especially outdoors and in car parks.
Tell customers what to expect, for example which app you use for payments and that you never ask for card details through a code on a sticker.
Prefer codes you control. Our guide to static and dynamic QR codes explains why a static code on your own domain is hard to hijack.

If you already entered details

Password: change it at once on the real site and anywhere else you used it, and turn on two-factor authentication.
Card or bank details: call your bank or card issuer immediately, using the number on your card or on their official website.
Something was installed: remove unknown apps or device profiles, and ask a professional to check the device if you are unsure.
Report it: to the police or your national fraud reporting service (in the US, ReportFraud.ftc.gov), and at work, to your IT or security team straight away.

QR Code Safety: How to Spot a Malicious QR Code