Quishing: The Sneaky QR Code Scam You Can Meet Anywhere

Why QR codes became a scammer’s favorite tool

QR codes used to feel like a novelty—something you might see on a poster or a product box. Now they’re part of ordinary life: you scan to pay for parking, view a menu, join a Wi‑Fi network, confirm a delivery, log into a web service, or download an app. That convenience is exactly why scammers like them. A QR code is basically a shortcut that turns a physical object (a sticker, a printout, a screen) into an action on your phone.

Quishing (a blend of “QR” and “phishing”) is when someone uses a malicious QR code to lure you into doing something unsafe—like entering your password on a fake login page, downloading a harmful app, or paying money to the wrong account. The trick is simple: you can’t tell where a QR code goes just by looking at it. With a normal web link, you can often spot something suspicious (“Why does my bank’s website look weird?”). With a QR code, the destination is hidden until you scan.

Think of it like picking up a sealed envelope from a bulletin board. The outside looks harmless. The moment you open it, you might be redirected to a convincing fake “official” page. Quishing is popular because it works in places where people are busy, rushed, or distracted—train stations, cafés, parking lots, event entrances, or office lobbies.

Newsletter

Never miss out on great articles — just enter your email and receive a weekly update!

Go

I have read and accept the Terms & Policy

How quishing works in everyday places (and why it’s convincing)

Most quishing isn’t high-tech wizardry. It’s often a low-effort physical trick: a scammer prints a QR code sticker and places it over a real one, or next to it, hoping you scan theirs instead. In other cases, the QR code is sent digitally (in an email, text message, or on social media) and pretends to be from a legitimate company or coworker.

Here are a few realistic scenarios to show how it plays out:

• The parking meter swap: You’re late for an appointment. You scan the QR code on the meter to pay. The page looks normal, asks for card details, and even shows the right street name. But it’s a fake payment site. You lose money, and your card details may be captured.
• The restaurant “new menu” sticker: A small sticker appears on the table saying “Scan for updated menu.” It leads to a page that asks you to “confirm” your phone number and email—then prompts you to install a “menu app.” That app isn’t a menu. It’s malware or an adware-laced installer.
• The workplace login trap: You get an email that looks like an IT notice: “New security policy—scan this QR code to re-authenticate on mobile.” The QR sends you to a login page that looks like Microsoft 365/Google Workspace. You enter credentials. The attacker immediately uses them to access your real account.
• The “missed delivery” flyer: A paper is left at your door with a QR code: “Reschedule delivery.” It leads to a fake courier site that asks for a small “redelivery fee.” Even if the fee is tiny, the goal is often your card number and personal info.

Quishing works because it stacks several psychological advantages:

1) It turns a physical cue into trust. People assume that something attached to a real parking meter or posted in an office is vetted. Scammers exploit that borrowed credibility.

2) It uses urgency and friction removal. QR codes are marketed as “fast.” Scammers want you to move quickly so you don’t scrutinize the URL or question why you’re being asked to log in again.

3) It hides the “tell.” With classic phishing, the suspicious URL is often visible in an email. With a QR code, the URL is hidden until after the scan—when you may already be in the habit of tapping “Continue.”

The most common outcomes of quishing are:

• Credential theft: stealing passwords for email, work accounts, banking portals, or social media.
• Payment diversion: sending money to a scammer-controlled payment page or account.
• Malicious app installation: tricking users into downloading an app outside official stores, or granting risky permissions.
• Personal data harvesting: collecting names, addresses, phone numbers, and other details for future scams.

If you want a quick mental model: a QR code is not “information.” It’s an instruction—often “open this link.” Treat it the same way you would treat a random link sent by a stranger.

How to scan QR codes safely (without becoming paranoid)

You don’t need to stop using QR codes. You just need a few habits that slow down the scammer’s favorite advantage: speed.

1) Look for signs of tampering in the real world

When the QR code is on a physical object, take two seconds to inspect it:

• Sticker on top of sticker: edges peeling, bubbles, mismatched print quality, or a slightly crooked overlay.
• Different branding style: the sticker uses a different logo, font, or color scheme than the rest of the signage.
• Odd placement: a QR code randomly added to a table tent, wall, or machine where you didn’t expect one.

A simple rule: if the QR code can be easily replaced with a sticker, it can be easily weaponized with a sticker.

2) Preview the link before opening it

Most phone cameras show a preview of the URL or the domain before you tap. Use that pause. You’re looking for:

• Misspellings and lookalikes: “paypaI.com” (with a capital i), “micros0ft-login.com,” or strange extra words.
• Unrelated domains: a parking payment that goes to a random domain you’ve never heard of.
• Short links: link shorteners can be legitimate, but they remove your ability to sanity-check the destination.

If the URL looks unfamiliar, back out and use an alternative route: the official app, the company’s website typed manually, or a known bookmark.

3) Use official apps for payments when possible

Parking and transit systems often have official apps. Using the official app reduces risk because you aren’t relying on a QR code to take you to the “right” payment page. Even if you discover the app through a QR code, don’t install directly from pop-ups—go to the official app store and search for it by name.

4) Be suspicious of “log in again” prompts

A very common quishing move is to send you to a login page that looks real. Ask yourself:

• Why would a restaurant menu require me to log in?
• Why would a parking meter ask for my email password?
• Why would IT ask me to scan a QR code in an email instead of using the standard login portal?

When in doubt, navigate to the service yourself rather than trusting a QR code as the starting point.

5) Watch for permission requests that don’t match the task

If scanning a QR code leads to an app download or a web app that requests permissions (contacts, SMS access, accessibility services, device admin, etc.), that’s a major red flag. A menu doesn’t need your contacts. A ticket page doesn’t need device administration. Scammers often rely on people tapping “Allow” repeatedly to get back to what they were doing.

6) Add a layer of account protection (because mistakes happen)

No one is perfect—especially when you’re in a hurry. A few defenses reduce damage if you ever do enter your password on a fake page:

• Enable multi-factor authentication (MFA) on important accounts (email, banking, work). Prefer authenticator apps or security keys when available.
• Use a password manager that auto-fills only on the correct domain. This is underrated: if you land on a fake site, your password manager often won’t fill, which is a built-in warning.
• Use virtual cards or strong payment protections where available, so card details are less reusable if stolen.

One last practical tip: when you’re in a place with staff—like a café, venue, or office—it’s completely reasonable to ask, “Is this the official QR code for payments/menu/login?” Scammers thrive on the assumption that nobody will.

QR codes aren’t going away. The goal isn’t fear—it’s friction in the right moment. A two-second pause to check the destination can save hours of account recovery later.