QR code scams (quishing)
Fake parking-meter stickers, emailed QR codes and package notices. Why QR codes are a perfect phishing disguise and how to scan safely.
Why criminals love QR codes
A QR code is just a link you cannot read. It hides the web address until after you scan it, it moves you from a work computer (with security filters) to a personal phone (often with fewer), and it feels official because QR codes are now everywhere: menus, parking meters, tickets and payment screens. Phishing with QR codes is often called quishing.
Common QR code scams
| Scam | How it works |
|---|---|
| Parking meter stickers | A fake QR sticker is placed over the real one; it leads to a payment page that steals card details |
| Email QR codes | "Scan to re-activate your multi-factor authentication" or "Scan to view the shared document", designed to slip past email link filters |
| Fake package notices | A card or flyer says a delivery failed; the QR code leads to a fee payment page |
| Restaurant and event codes | Stickers placed over genuine menu or ticket codes |
| Unsolicited parcels | Items you never ordered arrive with a QR code to "find the sender" or leave a review |
| Crypto payment codes | A scammer sends a QR code that pays their wallet, claiming it will pay you |
How to scan safely
- Look before you scan. Is the code a sticker on top of another code? Does it look tampered with? Avoid it.
- Read the preview. Most phone cameras show the address before opening it. Check that the domain matches the organization exactly.
- Never sign in or pay on a page that came from a QR code in an email. Open the official app or type the website yourself.
- For parking, use the city's official app or pay at the machine. Many cities have warned drivers about fake meter stickers.
- Do not scan codes on unexpected mail or parcels.
- Be careful with payment QR codes in crypto and payment apps: scanning someone's code sends money to them, it never receives money.
Your work's security tools may not see what you scan on your personal phone. If a work email asks you to scan a QR code to sign in, treat it as suspicious and report it.
If you scanned a bad code
If you only opened the page, close it, clear your browser tabs and you are usually fine. If you entered a password, change it right away and enable two-factor authentication. If you entered card details, call your bank for a new card. If the page made you download an app or profile, remove it and run a security scan; see phone security.
