QR Code Scams (Quishing): How to Spot & Avoid Malicious QR Codes
QR code scams, also known as 'quishing,' trick you into scanning a malicious QR code that leads to fake websites. These fake sites are designed to steal your personal information, login credentials, or even install harmful software on your device. Understanding how these sneaky scams work is crucial to protect your finances and privacy.
How This Scam Works
Scammers place a fake QR code in public places like parking meters, restaurant tables, or on physical mail like utility bills.
They may also send these malicious QR codes via email, text message, or social media, often pretending to be from a trusted company or government agency.
Once you scan the QR code, it directs you to a convincing but fraudulent website designed to mimic a legitimate service (e.g., a payment portal, login page, or survey).
The fake website then prompts you to enter sensitive information like credit card details, banking credentials, or passwords, which the scammers immediately steal.
Real Example
"A commuter parks their car and notices a sticker with a QR code placed over the card reader on a public parking meter, claiming to be a "new contactless payment option." Upon scanning it, they are taken to a website that looks exactly like the city's parking portal, asking them to enter their license plate number and credit card details to pay for parking. Unbeknownst to them, the website is fake, and their financial information is immediately stolen."
⚠️ Warning Signs
QR codes on physical signs that look tampered with, covered by stickers, or simply out of place.
An unexpected QR code arriving in an email, text, or social media message, especially if it's from an unfamiliar sender or demanding urgent action.
The landing page after scanning a QR code has an unusual or misspelled URL, even if the site itself looks legitimate.
The website asks for an unusual amount of personal or financial information without a clear, verifiable reason.
You encounter a "fake QR code parking meter" sticker that asks for payment via QR code when you'd normally pay by card or app.
The QR code prompts you to download an app or file before accessing the supposed service.
What To Do If You Encounter This Scam
Pause and inspect any physical QR code for signs of tampering before scanning it; if it looks suspicious, don't scan it.
If a QR code arrives digitally, verify the sender's identity through an official channel (e.g., call the company directly using a number from their official website, not from the message).
After scanning a QR code, always carefully check the URL of the landing page for authenticity before entering any information.
Report suspicious QR codes found in public to the establishment or authorities, and forward malicious digital QR codes to your email or text provider.
Already fell for it?
If you suspect you've scanned a malicious QR code and entered your information, immediately change passwords for any accounts that might be compromised. Contact your bank or credit card company to report fraudulent activity and monitor your statements closely. Consider freezing your credit to prevent further damage.
Scamtinel tip
Scamtinel helps by checking the safety of URLs that malicious QR codes often lead to. Before entering any personal information, you can copy the website address from your browser and paste it into Scamtinel to quickly see if it's a known phishing or scam site.
Check a suspicious link now →Related Scams
From the Blog
Last updated: May 3, 2026 · ← All scam types