QR code scams, also called quishing, trick you into scanning a code that opens a fake payment page, a login phishing site or a malicious download. Criminals stick fake codes on parking meters, send them in letters and emails, and hide them in fake “security update” messages. You can avoid most QR code scams by checking the web address before you enter any details and by paying through official apps.
Key takeaways
- A QR code is just a link; the danger is where it leads.
- Always read the web address your phone shows before opening it.
- Be wary of QR codes in emails, especially ones about passwords or MFA.
- Pay for parking and bills through official apps or websites you type yourself.
What are QR code scams?
QR code scams are phishing attacks that use a QR code instead of a clickable link. The code opens a fraudulent website that steals card details or passwords, or downloads malware. Because the link is hidden inside an image, email filters and people find it harder to spot.
Quishing is one form of the social engineering attacks that rely on trust and urgency.
Where do criminals place fake QR codes?
Criminals place fake QR codes on parking meters and EV chargers, restaurant tables, fake delivery or fine letters, and in emails pretending to be from IT. Physical stickers placed over real codes are especially effective because the location looks legitimate.
| Where | What the scam wants | Safer alternative |
|---|---|---|
| Parking meter sticker | Your card details | Use the council or operator app |
| Email “update your MFA” | Your work password and code | Contact IT through known channels |
| Letter about a fine or parcel | Payment or personal data | Type the official website address |
| Restaurant table | Card details on a fake checkout | Check the domain; pay at the till |
| Social media post | Crypto or prize “claims” | Ignore; real prizes do not need payment |
How can you avoid QR code scams?
You can avoid most QR code scams by checking the link preview before opening it, never entering passwords from a QR code in an email, and paying through official apps. Physical codes that look like stickers over the original deserve extra suspicion.
- Read the full web address your camera shows before tapping it.
- Look for stickers covering an original code.
- Do not scan codes in unexpected emails or texts.
- Never enter work passwords on a page opened from a QR code.
- Use official apps for parking and payments.
- Keep your phone updated.
- Report suspicious codes to the venue or your IT team.
Why are QR code phishing emails dangerous for businesses?
QR code phishing emails are dangerous because they move the attack from the protected work computer to a personal phone. Corporate email filters may not read links inside images, and phones often lack the same security controls as work laptops.
Common lures include “your MFA is expiring” or “review this shared document”. Train staff with real examples, as covered in our phishing training guide, and move to phishing-resistant sign-in such as passkeys.
What should you do if you scanned a scam QR code?
If you scanned a scam QR code and entered details, contact your bank immediately for card data, change the password for any account you entered, and turn on two-factor authentication. If you downloaded anything, run a security scan or ask IT to check the device.
Report phishing in the UK by forwarding emails to the NCSC Suspicious Email Reporting Service. In the US, report fraud to the FBI IC3.
Related reading
Business Email Compromise: How BEC Scams Work and How to Stop Them
What to Do After a Data Breach: A Step-by-Step Plan
What Does SLAM Stand For in Cyber Security? The SLAM Method Explained
Frequently asked questions
Can just scanning a QR code hack my phone?
Scanning alone rarely compromises an up-to-date phone. The risk comes from opening the link and entering details or downloading an app. Read the address first and close anything that looks wrong.
How can I check where a QR code goes?
Most phone cameras show the web address before opening it. Read the full domain carefully, looking for misspellings or unusual endings, before tapping.
Are QR code menus in restaurants safe?
Usually, but check that the code has not been covered by a sticker and that the address matches the restaurant or a known ordering service before entering card details.
Do businesses need QR code awareness training?
Yes. QR phishing targets staff through work email but moves the attack to personal phones. Include QR examples in regular phishing awareness training.
Next steps
QR code scams work because a code hides where it leads. Reading the address before you open it, and paying through official apps, stops almost all of them. Share the seven habits above with your team, and check your wider defences with the free Cybersecurity Readiness Assessment.
