QR Code Phishing Scams: How to Stay Safe in 2026

QR codes went from a curious marketing gimmick to an everyday tool for ordering food, paying bills, boarding flights, and connecting to Wi-Fi. Unfortunately, scammers followed the crowd. QR code phishing scams, also known as quishing, have exploded in recent years because the technology is fast, trusted, and visually impossible to inspect before scanning.

This guide explains exactly how QR code phishing works, the most common attack scenarios, and the practical steps you can take as a consumer or business to stay safe.

What Are QR Code Phishing Scams?

QR code phishing (quishing) is a social engineering attack where criminals use malicious QR codes to redirect victims to fraudulent websites, trigger malware downloads, or trick them into revealing sensitive information. Instead of sending a suspicious link in an email, attackers embed that link inside a QR code so it bypasses human inspection and many email security filters.

Because a QR code is just a pattern of black and white squares, you cannot read it with your eyes. You have to trust your phone to decode and open whatever URL is inside, which is exactly the gap attackers exploit.

Why QR Codes Are So Attractive to Scammers

• They look harmless. People associate QR codes with restaurants, parking meters, and advertisements, not with fraud.
• They bypass email filters. Traditional spam filters scan text and links, not the contents of embedded images.
• They move the attack to mobile. Phones often have smaller screens, fewer security tools, and users are more distracted.
• They are cheap to deploy. A scammer can print a sticker and slap it over a legitimate code in seconds.

How QR Code Phishing Attacks Work

Most quishing campaigns follow a predictable five-step pattern. Understanding it makes the warning signs much easier to spot.

1. Create a lookalike landing page. The attacker clones a legitimate login, payment, or verification page.
2. Generate a QR code pointing to that page. Often they use a URL shortener or a lookalike domain to disguise the destination.
3. Distribute the code. Via email, flyers, stickers over real codes, fake parking tickets, package slips, or social media ads.
4. Victim scans and lands on the fake page. The site asks for credentials, card details, 2FA codes, or installs a malicious app.
5. Attacker harvests data and either drains accounts, resells the credentials, or uses them for further attacks.

Common QR Code Phishing Scenarios

Quishing is not one single attack. It appears in many disguises, each tuned to a specific context where people are already expecting to scan something.

1. Fake Parking Meter and Transit Stickers

Scammers print realistic stickers and place them over legitimate QR codes on parking meters, EV chargers, or ticket machines. Victims scan, enter their card details to "pay for parking," and the data goes straight to criminals. Cities across the US, UK, and Europe have reported waves of these scams.

2. Quishing Emails Impersonating IT or HR

You receive an email claiming your Microsoft 365 password is expiring, your mailbox is full, or HR needs you to review a document. Instead of a link, there is a QR code with instructions to scan it with your phone. Because the attack moves off your corporate laptop and onto a personal device, endpoint protection often misses it entirely.

3. Fake Delivery and Package Notices

A note left at your door, or a text message, says a package could not be delivered. Scan the QR code to "reschedule." The destination is a cloned courier site that collects your address, phone number, and a small "redelivery fee" paid by card.

4. Restaurant Menu Swaps

Attackers cover menu QR codes in busy restaurants with their own stickers. Diners scan, see a fake Wi-Fi login or a "loyalty program" asking for personal info, and hand it over without a second thought.

5. Cryptocurrency and Investment Scams

Social media ads and fake influencer posts push QR codes that supposedly lead to exclusive investment platforms or crypto airdrops. The site asks you to connect your wallet, then drains it.

6. Fake Charity and Donation Codes

During disasters and holidays, scammers post QR codes claiming to collect donations for well-known charities. The money goes directly to criminal wallets, not to victims of the crisis.

Warning Signs of a Malicious QR Code

You cannot see what is inside a QR code with your eyes, but you can learn to notice the context around it. Here are the biggest red flags.

Warning Sign	Why It Matters
A sticker placed over another QR code	Classic physical tampering. Peel the corner gently to check.
QR code in an unsolicited email	Legitimate companies rarely require you to scan a code from your inbox.
Urgent language ("account suspended," "act now")	Urgency is a hallmark of social engineering.
Preview URL looks random, misspelled, or uses an unknown shortener	Trusted brands use their own domains or well-known services.
Request for login credentials or payment after scanning	A simple menu or Wi-Fi code should never need your password.
Prompt to install an app or profile	This is how malware and spyware get onto your device.

How to Stay Safe from QR Code Phishing

You do not need to stop scanning QR codes entirely. A few simple habits dramatically reduce your risk.

1. Always Preview the URL Before Opening

Modern iPhones and Android phones show the destination URL as a banner at the top of the screen before you tap it. Read it carefully. Does the domain match the brand you expect? Is there a weird country code, extra hyphen, or lookalike character (like paypa1.com instead of paypal.com)?

2. Treat Shortened Links with Extra Caution

Short links are useful and legitimate, but they can hide the final destination. If you must scan one, use a URL expander or paste the link into a link preview tool before visiting. If you create your own short links for marketing or sharing, use a reputable service with analytics and link scanning like Lunyb, which gives you full visibility into where every click actually lands. For more context on choosing the right tool, see our 2026 buyer's guide to URL shorteners.

3. Never Enter Credentials from a QR-Launched Page

If scanning a code leads you to a login screen, close the tab. Open the app or type the website address manually. This single habit defeats the majority of quishing attacks.

4. Verify Physical Codes Before Scanning

In the real world, run your finger over the code. Is it a sticker on top of another sticker? Is it crookedly placed, laminated differently from the rest of the sign, or covering an obvious original? If so, do not scan.

5. Use Your Phone's Built-In Camera, Not a Random Scanner App

The default camera apps on iOS and Android include safe URL previews. Many third-party QR scanner apps are themselves bundled with adware or trackers. Stick with what your phone ships with.

6. Keep Your Phone and Browser Updated

Operating system and browser updates patch the vulnerabilities that malicious pages try to exploit. Turn on automatic updates and do not postpone them for weeks.

7. Enable Multi-Factor Authentication Everywhere

Even if a scammer steals your password through a fake login page, strong multi-factor authentication (ideally with an authenticator app or hardware key, not SMS) stops them from getting in.

8. Pay by Trusted Apps Instead of Entering Card Details

For parking, deliveries, and bills, prefer official apps or tap-to-pay. If a QR code is the only option, pay with a virtual or single-use card number so a leak cannot drain your real account.

QR Code Phishing Protection for Businesses

Employees are now a primary target. Attackers send quishing emails specifically because the attack jumps to a personal phone outside corporate protections. Businesses should take a layered approach.

Technical Controls

• Email security that scans images. Choose a secure email gateway that extracts and analyzes URLs embedded in QR codes, not just text links.
• Mobile device management (MDM). Enforce OS updates, block risky app installs, and require screen locks on any device accessing company data.
• Phishing-resistant authentication. Hardware security keys and passkeys stop credential theft dead, even if a user is tricked into submitting a password.
• Encrypted DNS and content filtering on company networks to block known phishing domains before pages load.

People and Process Controls

• Run quishing-specific simulations, not just classic email phishing tests.
• Teach staff to treat any QR code in an email as suspicious by default.
• Give employees a clear, friction-free way to report suspicious codes or messages.
• Audit printed marketing materials and in-office signage so staff can spot tampering with the company's own codes.

What to Do If You Scanned a Malicious QR Code

Mistakes happen. If you suspect you fell for a quishing attack, act quickly to limit the damage.

1. Disconnect from the internet if you downloaded anything, by enabling airplane mode.
2. Do not enter any more information on the suspicious page. Close the browser tab immediately.
3. Change passwords for any account whose credentials you may have entered. Start with email and banking.
4. Revoke active sessions in each affected account's security settings.
5. Contact your bank if you shared card details and request a new card plus fraud monitoring.
6. Run a malware scan using your phone's security tools or a reputable mobile security app.
7. Report the scam to your local cybercrime authority (such as the FTC in the US, Action Fraud in the UK, or the ACCC's Scamwatch in Australia) and to the brand that was impersonated.
8. Monitor your accounts and credit for the next several months and freeze your credit if sensitive personal info was exposed.

The Future of QR Code Phishing

Expect quishing to grow, not fade. AI-generated landing pages are now nearly indistinguishable from real brand sites, and generative tools can produce convincing fake emails in any language within seconds. We are also seeing dynamic QR codes that change their destination after the first few scans, letting attackers show a clean page to security scanners and a malicious page to real victims.

The defense will not come from avoiding QR codes. They are too useful. It comes from building the habit of pausing for two seconds before you tap, verifying the URL, and refusing to log in or pay from a page you reached by scanning. For marketers and creators using short links responsibly, platforms like Lunyb make it easy to generate trustworthy, trackable codes so your own audience is not conditioned to click blindly on sketchy destinations.

Frequently Asked Questions

Can simply scanning a QR code infect my phone?

In almost all cases, no. A QR code just contains a URL or text. The danger comes from what happens after you tap through to the destination: entering credentials on a fake site, downloading a malicious app, or granting a device profile. Modern phones will not silently install anything from a scan alone.

How can I check a QR code's link safely before visiting it?

Use your phone's native camera, which displays the URL as a preview before opening. For a deeper check, copy the link and paste it into a URL expander or a reputation checker like Google Safe Browsing, VirusTotal, or urlscan.io. If the destination domain looks unfamiliar, do not visit it.

Are QR codes in emails always a scam?

Not always, but you should treat them with heavy suspicion. Legitimate companies rarely require you to scan a code from an email when they could simply include a clickable link. Quishing emails are one of the fastest-growing phishing categories in 2025 and 2026, so when in doubt, delete and go directly to the company's official app or website.

What is the difference between phishing and quishing?

Phishing is the broad category of scams that trick people into revealing information, usually via email or text with malicious links. Quishing is a subset that uses QR codes as the delivery vehicle. The payoff is the same for the attacker, but QR codes slip past many traditional security filters and shift the attack onto mobile devices.

Is it safe to use QR codes for payments?

QR codes themselves are a safe payment technology when used inside trusted apps like your bank's own app, Apple Pay, Google Pay, or established merchants. The risk is scanning an untrusted code from a sticker, flyer, or email that leads to a fake payment page. Prefer official apps and avoid typing card details into any page reached by scanning a random code.