QR Code Phishing Scams: How to Stay Safe in 2026

QR codes have quietly become part of daily life — you scan them to pay for parking, view restaurant menus, verify tickets, and log into apps. But the same convenience that made QR codes ubiquitous has also made them a favorite tool for cybercriminals. This new attack category, known as QR code phishing — or quishing — is rising fast, and most people have no idea how to spot it.

This guide explains exactly how QR code phishing scams work, the tactics attackers use, real-world examples, and the practical steps you can take to stay safe when scanning any code.

What Is a QR Code Phishing Scam?

A QR code phishing scam is a social engineering attack in which criminals use a malicious QR code to redirect victims to a fake website, trigger a harmful download, or trick them into entering sensitive information. Because QR codes hide the destination URL behind a scannable image, users often can't tell where a code actually leads until it's too late.

The term "quishing" is a blend of "QR" and "phishing." Unlike email phishing, where a suspicious link is visible, a QR code obscures the URL — making the traditional "hover before you click" advice useless.

Why Attackers Love QR Codes

Trust bias: People assume printed QR codes on posters, receipts, or invoices are legitimate.
Mobile-first attacks: Scans happen on phones, which often have weaker security controls than desktops.
Bypasses email filters: A QR code inside an image can slip past spam and malware scanners.
Anonymity: Attackers can easily replace or overlay physical codes without being noticed.

How QR Code Phishing Attacks Work

Most QR code scams follow a predictable four-step pattern. Understanding this flow makes it much easier to recognize an attempt before you fall for it.

The bait: A QR code is placed somewhere the victim will encounter it — an email, a poster, a parking meter sticker, a fake package delivery notice, or even an invoice PDF.
The scan: The victim opens their phone camera and scans the code, expecting a normal destination like a login page, payment portal, or menu.
The redirect: The code leads to a spoofed website — often a near-perfect clone of a real brand's login page, payment gateway, or account verification form.
The harvest: The victim enters credentials, card details, or one-time passcodes, which are immediately captured by the attacker. In some cases, the site silently drops malware onto the device.

Common Types of QR Code Phishing Scams

QR code fraud comes in many flavors. Here are the most common variations you're likely to encounter.

1. Parking Meter and Public Sign Overlays

Scammers print stickers with malicious QR codes and paste them over legitimate codes on parking meters, EV chargers, and city signage. Victims think they're paying for parking but are actually entering card details into a phishing site.

2. Email-Based Quishing

An email that looks like it's from Microsoft, DocuSign, HR, or a bank includes a QR code and urges the recipient to "scan to verify your account" or "review a secure document." Because the QR code is an image, most email security tools don't inspect it.

3. Fake Delivery and Package Notices

A postcard or door hanger claims a package couldn't be delivered. Scanning the QR code leads to a fake courier site asking for personal details and a small "redelivery fee."

4. Restaurant Menu Swaps

Attackers replace table QR menus with codes leading to fake "pay your bill" pages or ones that harvest loyalty account credentials.

5. Cryptocurrency and Payment Scams

Fraudsters send QR codes representing wallet addresses. Victims scan the code and unknowingly send crypto directly to the attacker's wallet.

6. Fake Wi-Fi Codes

In cafés, airports, or hotels, a poster offers "free Wi-Fi — scan to connect." The code silently joins the phone to a rogue network that intercepts traffic.

QR Code Phishing vs. Traditional Phishing

QR-based attacks share the same goal as email or SMS phishing, but the tactics and defenses differ significantly.

Feature	Traditional Phishing	QR Code Phishing (Quishing)
Primary channel	Email, SMS, chat	Printed codes, images in emails, posters
URL visibility	Visible (can be hovered)	Hidden inside the QR image
Device targeted	Usually desktop	Almost always mobile
Security filter effectiveness	High (mature filters)	Low (images often unscanned)
User awareness	Moderate to high	Very low
Detection difficulty	Medium	High

Red Flags to Watch For

Not every QR code is dangerous, but certain warning signs should immediately make you pause before scanning.

Stickers on top of other codes. If a QR code looks like it's been pasted over another surface, don't scan it.
Unsolicited emails with QR codes. Legitimate companies almost never require you to scan a QR code to "verify" or "re-authenticate" an account.
Urgent language. "Your account will be suspended in 24 hours — scan now to fix it."
Requests for credentials after scanning. If a QR code leads to a login page you didn't expect, close it.
Shortened or unfamiliar domains. Preview the URL before opening it and check whether the domain matches the brand.
Codes in public places with no branding. A random QR code taped to a lamppost is almost never legitimate.
Prompts to install apps or profiles. Never install a configuration profile or unknown app from a scanned link.

How to Stay Safe: 10 Practical Steps

Here is a straightforward checklist you can use every time you're about to scan a QR code.

Preview the URL first. Most modern phone cameras show the destination URL before opening it. Read it carefully.
Check the domain. Look for misspellings like "paypa1.com" or "micros0ft-login.com."
Look for HTTPS — but don't rely on it alone. Attackers use HTTPS too; the padlock only means encryption, not legitimacy.
Never enter credentials from a scanned link. If you need to log in, open the app or type the URL manually.
Inspect physical codes. Peel-test suspicious stickers. Businesses expect this from cautious customers.
Turn off automatic actions. Disable auto-open of URLs and auto-download of files from QR scans in your camera app.
Use a QR scanner with safety checks. Some scanning apps flag known malicious domains.
Enable multi-factor authentication. Even if credentials leak, MFA blocks most account takeovers. Use an authenticator app rather than SMS when possible.
Keep your phone updated. OS patches close vulnerabilities that malicious pages may try to exploit.
Report suspicious codes. Notify the business, venue, or IT team so the code can be removed.

How Businesses Can Reduce QR Code Phishing Risk

Organizations that use QR codes for marketing, payments, or authentication have a responsibility to make them harder to spoof. Here are proven mitigations.

Use Branded, Trackable Short Links

Instead of raw URLs, generate QR codes from a branded short link so users see a recognizable domain when previewing. This also lets you monitor scan analytics and detect abnormal traffic patterns. Trusted link platforms like Lunyb let you create shortened, trackable URLs and generate QR codes that you can update or disable if abuse is detected — a critical safety feature that raw QR codes lack.

Tamper-Evident Physical Design

Print QR codes directly onto surfaces (menus, receipts, signage) rather than using stickers. If stickers are necessary, use tamper-evident materials that show visible damage when peeled.

Educate Employees and Customers

Include short reminders next to physical codes: "Verify the URL preview before entering personal information." Train staff to recognize overlay attacks on shared equipment.

Filter QR Codes in Email Security

Modern email security tools can extract QR codes from image attachments and analyze the underlying URL. If your current gateway doesn't do this, upgrade.

Adopt Phishing-Resistant Authentication

Use FIDO2 security keys or passkeys for sensitive systems. Even if a user is tricked into visiting a spoofed site, phishing-resistant credentials won't authenticate to it.

What to Do If You've Already Scanned a Malicious QR Code

If you suspect you've fallen for a quishing attack, act quickly to limit the damage.

Disconnect the device. Turn off Wi-Fi and mobile data to stop any active data exfiltration.
Do not enter more information. Close the browser tab or app immediately.
Change affected passwords. Start with the most critical accounts — email, banking, work logins.
Enable or reset MFA. Revoke old MFA methods and set up new ones.
Contact your bank. If you entered card or banking details, request a card block and monitor for fraudulent transactions.
Run a security scan. Use a trusted mobile security app to check for malware.
Report the incident. File a report with your local cybercrime authority and, if it's a work device, notify your IT/security team.
Monitor your identity. Watch for unusual account activity or credit inquiries for the next several months.

The Future of QR Code Attacks

QR code phishing isn't going away — it's evolving. Expect to see more AI-generated phishing pages that perfectly mimic real brands, dynamic QR codes that change destinations based on the scanner's location or device, and hybrid attacks that combine QR codes with voice phishing ("vishing") calls. As authentication systems move toward passkeys and device-bound credentials, attackers will lean even harder on social engineering channels where QR codes thrive.

The best long-term defense is a habit: treat every QR code the same way you'd treat a link in an unexpected email. Pause, preview, verify — then scan.

Frequently Asked Questions

Can simply scanning a QR code infect my phone?

In most cases, scanning a code only reveals a URL — it does not automatically install malware. The risk comes from what you do next: visiting the site, entering data, or installing something. That said, sophisticated attackers can chain QR-based redirects with browser or OS exploits, so keeping your device updated is essential.

How can I tell if a QR code is safe before scanning?

You can't judge safety from the code image itself — all QR codes look similar. Instead, look at the physical context (Is it a sticker on top of another code? Is it in an unusual location?) and always preview the destination URL your camera app shows before opening it.

Are QR codes in emails always dangerous?

Not always, but they should be treated with high suspicion. Legitimate companies rarely require you to scan a code from an email to log in or verify an account. When in doubt, ignore the code and log in directly through the official app or website.

Do QR code scanner apps protect me from phishing?

Some scanner apps include URL reputation checks and can warn you about known malicious domains. They add a useful layer of defense, but they won't catch brand-new phishing sites. Your own vigilance is still the strongest safeguard.

What's the difference between quishing and smishing?

Smishing is phishing delivered via SMS text messages, usually containing a malicious link. Quishing uses QR codes to hide the destination URL. Both aim to steal credentials or money, but quishing is harder to detect because the URL isn't visible until after the scan.