Tech

What is phishing by QR code and how to avoid it

Rive News Research Desk

Published October 16, 2026 · 7 min read

Key takeaways

Phishing by QR code, called quishing, hides a fake link inside a scannable square that your eyes cannot read.
Scammers stick fake codes over real ones, or send them in emails that dodge normal link filters.
Preview the link before you tap it, and type the real address yourself when anything feels off.

A person holding a smartphone up to scan a QR code — A person holds a smartphone up to scan a QR codePhotograph: iMin Technology / PexelsImage: Pexels

Phishing by QR code is a scam that uses a QR code to send you to a fake website. The site then tries to steal your password, your card details, or your personal information. The attack is often called quishing, a blend of QR and phishing.

A QR code is a square pattern of black and white blocks that stores a link, a payment address, or a short piece of text. Your phone camera reads the pattern and opens whatever it points to. The catch is that you cannot read the pattern yourself, so you cannot tell where it leads until your phone shows you a preview.

This article explains what phishing by QR code is, how the scam works in its common forms, why it fools careful people, and how to check a code before you trust it.

What is phishing by QR code?

Phishing is a con that tricks you into handing over sensitive information by pretending to be someone you trust. Classic phishing uses an email with a fake link. Phishing by QR code swaps the visible link for a square pattern, which makes the trap harder to spot.

QR codes were developed in the 1990s by the Japanese company Denso Wave to track parts in manufacturing. They spread because they are fast: one scan opens a menu, a payment page, or a login screen with no typing. Scammers exploit exactly that speed.

A scan feels like one small action, not a decision about trust.

The danger is not the code itself. A QR code is only a container, like an envelope. The risk sits in the address inside it.

A fake code points to a copy of a real site, built to collect whatever you type.

How the scam works

Most quishing attacks follow the same three steps. First, the scammer places a fake code where a real one belongs. Second, you scan it and land on a convincing copy of a login or payment page.

Third, you type in credentials or card details, and the scammer collects them.

The parking meter version is the one regulators warn about most. Scammers cover the real code on a meter with a sticker carrying their own code. You scan it, a payment page opens, and you enter card details that go to the scammer.

In September 2026, the US Federal Trade Commission issued a consumer alert about exactly this trick, after reports of fake codes pasted over real ones on parking meters.

The email version works differently but ends the same way. An email arrives with a QR code instead of a clickable link, often framed as an invoice, a payroll update, or a document to review. Because the link hides inside an image, some email filters cannot inspect it the way they inspect a normal link.

Scanning moves you from a managed work computer to your personal phone, where fewer protections may apply.

A third version targets everyday places. Fake codes appear on restaurant tables in place of menu codes, on flyers promising a prize, or on fake delivery notices claiming a missed parcel. The pages they open may ask for a small redelivery fee plus full card details, or a login to view a document.

Any page reached by QR code that asks for a password or payment deserves a hard pause.

Why QR codes fool careful people

The first reason is simple: you cannot read a QR code. A normal link shows you the address before you click, and a misspelling like "paypa1" can tip you off. A QR code shows you a pattern of squares.

You only learn the address when your phone displays a preview, and many people tap through the preview without reading it.

The second reason is context. A code on a real parking meter, a real restaurant table, or a real office poster borrows trust from its surroundings. You assume the code belongs there because everything around it looks genuine.

Scammers count on that assumption, and a neat sticker is cheap to print.

The third reason is urgency. Quishing messages push the same buttons as other phishing: a package that could not be delivered, a problem with your account, or suspicious activity that needs a password change now. Urgency shortens the pause in which you might check the address.

If a code demands immediate action, treat that pressure as a warning sign, not a reason to hurry.

A parking meter with a Park and Pay sign on a city street — A parking meter with a payment sign on a city streetPhotograph: PexelsImage: Pexels

How to check a QR code before you trust it

Start with the physical code. Look for a sticker pasted over another code, peeling edges, crooked placement, or printing that does not match the rest of the sign or meter. If the code looks added on, do not scan it.

In one US city, Asheville in North Carolina, officials found around 20 fake codes stuck on downtown meters in February, and that city does not use QR codes for parking payments at all.

Next, read the preview. Most phone cameras show the web address before they open it. Check for misspellings, swapped letters, and a domain that does not match the company you expect.

If the preview bounces through a link shortener or an unfamiliar domain, close the browser instead of continuing.

Skip the code when a safer route exists. If you need to pay for parking, open the parking operator's official app or type its website address yourself. If an email asks you to scan a code to view a document, contact the sender through a number or address you already know.

Typing the address yourself removes the QR code from the decision entirely.

Keep your phone updated, and use strong, unique passwords plus multi-factor authentication on important accounts. Updates close holes that a malicious link could exploit. Multi-factor authentication means a stolen password alone is not enough to get into your account.

If you ever wonder whether a password of yours has already leaked, check whether your email password appeared in a breach and change it if it has.

Be careful with codes in unexpected messages. Do not scan a QR code in an email or text you did not ask for, especially one that demands immediate action. The same caution applies on public Wi-Fi networks, where a fake login page can do extra damage.

What to do if you already scanned a bad code

Do not keep interacting with the site. If someone contacts you through the page, do not answer. Scammers use follow-up messages to pull out more money or information.

Change your password right away if you entered login details. Change it anywhere else you reused the same password, because scammers try stolen credentials on other services. Two-factor authentication limits the damage, but a fresh password still matters.

Review your bank and card statements for transactions you do not recognize. If you spot one, dispute it with your card issuer. Then report the scam to the FTC fraud reporting site.

Reports help regulators track where fake codes are appearing.

One real case shows why speed matters. Police in New Westminster, British Columbia, reported fake "scan to pay" stickers on parking meters, and said one victim lost 2,000 dollars after entering card details on a fake payment site. The loss came from a code that looked ordinary on a meter that was real.

The bottom line

Phishing by QR code works because the code hides its destination and borrows trust from the place it sits. The defense is a short pause: inspect the code, read the preview, and type the real address yourself when anything feels off. That pause costs a few seconds, and it beats rebuilding a compromised account.

Tags: QR codes, phishing, online safety, scams

Latest in Tech

Subscribe to the Rive News newsletter for one practical safety guide each week.

TaggedQR codesphishingonline safetyscams