QR Code Scams (Quishing): How to Spot a Fake QR Code

What is quishing?

Quishing is phishing with a QR code. Instead of a suspicious link in an email, the scammer gives you a QR code that leads to a fake login page, a fake payment page or a malicious download. Because you cannot read a QR code by looking at it, it is easier to trick people, and email filters have historically been worse at checking images than text links.

Consumer protection bodies including the US Federal Trade Commission and the UK's Action Fraud have published warnings about QR code scams, particularly around parking payments and fake delivery notices.

Common QR code scams

Watch out for these patterns:

• Stickers on parking meters and EV chargers that lead to a fake payment site.
• Emails claiming your Microsoft 365 or bank password expires, with a QR code to 'verify'.
• Fake parcel delivery cards or letters asking you to scan and pay a small fee.
• Stickers placed over a restaurant's genuine menu QR code.
• QR codes on social media promising giveaways or crypto rewards.

Warning signs of a fake QR code

Look at the physical code first. A sticker placed on top of signage, a code that looks misaligned, or a second code next to an official one are all red flags. Then read the link preview your camera shows before tapping it.

• The domain does not match the organisation (for example a council parking page on an unrelated .xyz domain).
• Shortened links that hide the real destination.
• The page asks for passwords, bank details or a one-time code immediately.
• Urgency: 'pay within 1 hour or receive a fine'.

What to do if you scanned a fake code

Do not enter any more information. If you entered card details, contact your bank immediately and ask them to block the card. If you entered a password, change it everywhere you used it and turn on two-factor authentication. In the UK you can report fraud to Action Fraud; in the US, report it to the FTC at ReportFraud.ftc.gov; in EU countries, contact your national police or consumer protection authority.

How businesses can protect customers

If you display QR codes in public, make them hard to imitate and easy to verify:

• Point codes at your own, recognisable domain, not an unfamiliar short link.
• Add your logo and brand colours so a plain replacement sticker stands out.
• Print the destination URL in text under the code so people can compare.
• Check public codes regularly for stickers placed on top.
• Use static codes so there is no third-party redirect that could be hijacked or expire.