QR codes have become so common that we scan them almost without thinking. That is exactly why cybercriminals have started using them to trick people. The technique has a name: quishing, a blend of *QR* and *phishing*. In this article we explain how these scams work, how to spot them and what you can do to protect yourself, whether you scan codes or use them in your business.
What quishing is
Quishing is a type of fraud in which a QR code leads to a fake page designed to steal personal data, passwords or banking details, or to take a payment that is not owed. Unlike a link in an email, a QR code does not show the address at a glance, which makes the trick harder to spot before opening it.
The most common scams
Stickers over legitimate codes
Scammers place a sticker with a fake code over the original one on parking meters, charging stations, restaurant menus or posters. Users think they are paying for parking, but they enter their card details on a fraudulent site.
Fake emails and letters
Messages that imitate a bank, a delivery company, a government agency or your company’s IT department and include a QR code to “verify your account”, “pay an outstanding fee” or “reschedule a delivery”. Because the code is an image, some email filters do not analyze it.
Payments to the wrong account
In QR payments, the fake code may lead to a payment page that sends the money to the scammer.
Malicious app downloads
Codes promising a useful app (for an event, a restaurant, a public service) that actually lead to downloading an app from outside the official stores.
Warning signs
| Sign | What it may indicate |
|---|---|
| Sticker on top or badly cut | Fake code stuck over the original |
| Strange web address or typos | Imitation of a legitimate site |
| Urgency (“pay today or lose…”) | Pressure typical of scams |
| Asks for password or card details right away | Phishing page |
| QR code in an unexpected email | Possible email quishing |
| Unknown link shorteners | Hide the real destination |
Tips for users
- Look at the code before scanning. If it looks like a sticker over another code or is peeling off, be suspicious.
- Check the address your phone shows before opening it. Make sure the domain is the one you expect.
- Do not enter passwords or banking details on a page you reached through a QR code unless you are completely sure.
- Use official apps to pay for parking, transport or public services, rather than a code on the street.
- Be wary of QR codes in unexpected emails. If a bank or company asks you for something, go to its website by typing the address yourself.
- Download apps only from the App Store or Google Play.
- Keep your phone updated so you have the latest security protections.
Tips for businesses
If you use QR codes in your business, you can protect your customers too:
- Check your codes regularly on tables, posters and windows for stickers placed by others.
- Print codes as part of the material (on the menu, on the poster) rather than using stickers that are easy to replace.
- Show your domain next to the code, for example “yoursite.com/menu”, so customers can check the destination matches.
- Add your logo and brand colors: a custom code is harder to imitate than a generic one.
- Use your own domain in links whenever you can.
- Tell your staff to report any strange code they notice.
What to do if you have been scammed
- Contact your bank immediately to block the card or the transaction.
- Change any passwords you entered, starting with your email and online banking.
- Turn on two-factor authentication for your important accounts.
- Report the fraud to the authorities in your country and, if it happened at a business, tell the people in charge.
- Monitor your transactions over the following weeks.
Are QR codes dangerous?
No. A QR code is no more dangerous than a link: it is just a way to open an address. The risk lies in the destination, not the code. With a few simple habits, like checking the address and being wary of stickers and unexpected emails, you can keep enjoying their convenience safely.
Frequently asked questions
Can scanning a QR code infect my phone?
Scanning on its own does not install anything. The danger comes if you open a fraudulent page and download a file or enter data. Always check the destination before opening it.
How do I know if a QR code is safe?
Check the address your phone shows, the physical condition of the code and the context. If something does not add up, do not open it.
Are codes created with QRcrea safe?
The codes you create with the QRcrea generator lead exactly to the destination you enter. The safety of the destination depends on the link you choose.
Conclusion
Quishing exploits the trust we place in QR codes, but it is easy to avoid with a little attention: check the address before opening it, be wary of stickers and unexpected emails and do not enter sensitive data unless you are sure. If you run a business, customize your codes, show your domain and check them regularly. Create branded codes with the QRcrea QR code generator.
Ready to create your QR code?
Customize it with your colors and logo, and download it for free in seconds.
