QR Code Phishing Scams: How to Stay Safe in 2026

QR codes went from novelty to necessity in just a few years. We scan them for restaurant menus, parking payments, concert tickets, Wi-Fi logins, and package tracking. But that same convenience has created a booming new attack surface: QR code phishing scams, also known as quishing. Instead of a suspicious link in an email, criminals now hide malicious URLs inside pixelated squares that your phone obediently opens with no second thought.

This guide explains exactly how QR code phishing works, the most common scams happening right now, warning signs to watch for, and the practical steps you can take to stay safe, whether you are an everyday user, a small business owner, or an IT administrator.

What Are QR Code Phishing Scams?

QR code phishing (quishing) is a social engineering attack in which a criminal uses a QR code to redirect victims to a fraudulent website, trigger a malicious download, or trick them into entering sensitive information such as passwords, payment details, or multi-factor authentication codes.

The attack works because a QR code is essentially a visual URL. Humans cannot read it, so we rely entirely on the device to interpret it. That gap between what you see (a harmless-looking square) and what your phone does (opens a URL instantly) is the vulnerability attackers exploit.

Why QR Code Phishing Is Growing Fast

• Trust by habit. We have been trained during the pandemic era to scan without hesitation.
• Email filters miss them. Most security gateways scan text and links, not the contents of image attachments.
• Mobile-first targeting. Phones often lack the enterprise security controls installed on desktops.
• Cheap to deploy. Printing stickers or sending an image costs almost nothing.
• Hard to attribute. A physical sticker in a car park leaves little digital trail.

How a QR Code Phishing Attack Actually Works

Most quishing attacks follow the same basic playbook, whether they arrive by email, text, or a sticker on a lamppost.

1. Lure creation. The attacker builds a convincing pretext: a parking fine, a package delivery notice, a multi-factor authentication reset, a menu, or a bank security alert.
2. Malicious URL generation. They register a lookalike domain (e.g. paypaI-secure.com with a capital "i" instead of an "l") or use a free hosting service.
3. QR code encoding. The malicious URL is converted into a QR code, often with a shortener layered on top to disguise it.
4. Distribution. The code is embedded in a PDF attachment, printed on a flyer, placed over a legitimate code, or sent in a text message.
5. Victim scan. You scan with your phone camera. The browser opens the fraudulent site.
6. Harvest or infect. You enter credentials, approve a payment, or unknowingly download malware.

The Most Common QR Code Phishing Scams Right Now

1. Parking Meter and EV Charging Scams

Criminals print stickers with fake QR codes and place them over legitimate ones on parking meters, charging stations, or pay-and-display signs. Drivers scan, land on a convincing payment page, and hand over their card details plus personal information. Cities across the UK, US, Australia, and parts of Europe have reported these in 2024 and 2025.

2. Fake Delivery Notifications

A card is left at your door, or a text arrives saying a package could not be delivered. A QR code promises to let you reschedule. Instead, it leads to a cloned courier website asking for a small "redelivery fee" plus your address and card number.

3. Business Email Quishing (Microsoft 365 / Google Workspace)

An email arrives claiming your password is expiring or a secure document is waiting. Because the link is now a QR code inside an image or PDF, it slips past many email filters. Scanning on a phone takes employees to a near-perfect Microsoft or Google login page, where credentials and MFA tokens are stolen in real time.

4. Restaurant Menu Overlays

Attackers paste new QR stickers on top of the real menu QR at a restaurant table. The fake code leads to a "menu" that first asks you to sign in with Google or pay a small cover charge.

5. Cryptocurrency Wallet Draining

Fake donation posters, charity flyers, or "airdrops" use QR codes that connect your wallet to a malicious smart contract. One confirmation and the balance is gone.

6. Fake Wi-Fi Login Codes

A poster in a cafe or airport invites you to "scan to connect." The code configures your phone to join a rogue hotspot run by the attacker, who then intercepts traffic.

QR Phishing vs Traditional Phishing: Key Differences

Factor	Traditional Email Phishing	QR Code Phishing (Quishing)
Delivery channel	Clickable link in email or SMS	Image, PDF, printed sticker, poster
URL visibility before click	Visible on hover (desktop)	Hidden until after scan
Device commonly used	Desktop or laptop	Personal mobile phone
Caught by email filters	Often yes	Frequently no
Security software coverage	Strong on corporate endpoints	Weaker on BYOD mobile devices
Physical component	None	Can be deployed in the real world

Warning Signs of a Malicious QR Code

You cannot judge a QR code by its appearance alone, but there are strong contextual clues that something is off.

• A sticker over another sticker. Peel-back layers on parking meters, posters, or menus are a huge red flag.
• Unsolicited emails with QR codes. Legitimate password resets never require you to scan a code with your phone.
• Urgency language. "Your account will be locked in 24 hours" paired with a QR code is almost always a scam.
• Mismatched branding. A "Microsoft" email sent from a Gmail or random domain address.
• Shortened URL preview that does not match the brand. If the preview shows a random domain instead of the expected company, stop.
• Requests for credentials after scanning. If scanning a menu asks you to log in with Google, it is not a menu.
• Browser warnings. Any certificate error after a scan should end the session immediately.

How to Stay Safe: A Practical Checklist

For Everyday Users

1. Preview the URL before opening. Modern iPhone and Android cameras show the destination link above the camera viewfinder. Read it carefully before tapping.
2. Look for the padlock and the correct domain. HTTPS is not proof of safety, but no HTTPS is proof of danger.
3. Never enter credentials on a page you reached via QR code. Open the official app or type the URL manually instead.
4. Inspect physical codes. Run a fingernail across stickers in public places. If the edge lifts, it may be an overlay.
5. Use your phone's built-in camera, not random scanner apps. Many free scanner apps are themselves adware or trackers.
6. Keep your phone updated. Browser and OS patches close many of the exploits used in post-scan attacks.
7. Enable encrypted DNS. Services like Cloudflare 1.1.1.1 or NextDNS can block many known phishing domains at the network level.
8. Turn on phishing protection in your browser. Safari, Chrome, Firefox, and Edge all offer this and should stay enabled.

For Business Owners and IT Teams

1. Train staff specifically on quishing. Generic phishing training rarely covers QR scenarios.
2. Deploy email security that scans images and PDFs for embedded QR codes, not just links.
3. Enforce phishing-resistant MFA such as hardware security keys (FIDO2), which neutralize most credential-harvest attacks.
4. Audit your own public QR codes regularly. If you print codes on menus or packaging, check them weekly for tampering.
5. Use a reputable branded shortener so customers learn to trust your specific domain and spot imposters more easily.
6. Publish a QR code policy on your website so customers know what your real codes look like and where they live.

The Role of URL Shorteners (Good and Bad)

Shortened links inside QR codes are a double-edged sword. On one hand, attackers love generic shorteners because they obscure the final destination. On the other hand, branded and trusted shorteners actually help users verify a link because the domain itself becomes a trust signal.

A reputable shortener gives you several defensive features:

• Link previews so recipients can see where they are going.
• Click analytics that can reveal unusual traffic patterns suggesting abuse.
• Password-protected or expiring links that limit exposure.
• Domain-level reputation that is quickly blocked by browsers if abused.

For a deeper comparison of trustworthy options, see our 2026 buyer's guide to the best URL shorteners, our honest review of Lunyb, and our Rebrandly 2026 review. Choosing a shortener with strong link hygiene, like Lunyb, helps your audience distinguish your real QR campaigns from imposter stickers.

What to Do If You've Already Scanned a Malicious QR Code

Scanning alone rarely compromises you; the damage usually happens after you interact with the destination page. If you scanned something suspicious, act quickly but methodically.

1. Close the browser tab immediately and do not enter any information.
2. Disconnect from Wi-Fi and mobile data if a download started.
3. Check for unknown apps or configuration profiles (iOS: Settings → General → VPN & Device Management; Android: Settings → Apps).
4. Change any passwords you entered on the fake page, starting with email and banking.
5. Revoke active sessions on Microsoft 365, Google, or any account you logged into.
6. Contact your bank if you entered card details, and request a card replacement.
7. Run a mobile security scan with a reputable tool.
8. Report the scam to your local cybercrime authority (Action Fraud in the UK, FTC/FBI IC3 in the US, Scamwatch in Australia) and to the brand that was impersonated.

The Future of QR Code Phishing

Expect quishing to grow more sophisticated through 2026 and beyond. We are already seeing:

• Dynamic QR codes that serve a safe page to security scanners and a phishing page to real users based on device fingerprinting.
• AI-generated clone sites built in seconds, making lookalikes nearly indistinguishable from the real brand.
• Hybrid attacks combining QR codes with voice phishing (vishing), where a scanned code triggers a phone call from a fake "support agent."
• Physical quishing in high-trust locations such as hospitals, government offices, and transport hubs.

The defense is not to stop using QR codes, which remain genuinely useful. The defense is to treat every scan the way you would treat clicking a link in an unsolicited email: with a brief, deliberate pause to check the destination.

Frequently Asked Questions

Can simply scanning a QR code hack my phone?

In almost all cases, no. Scanning only decodes the data (usually a URL). The risk begins when you tap through to the destination, enter information, or install something. However, scanning does expose your browser to any zero-day exploits present on the destination page, which is why keeping your phone updated matters.

How can I check a QR code safely before opening it?

Use your phone's native camera and read the URL preview that appears above the viewfinder before tapping. For extra caution, scan with a QR app that lets you copy the link to the clipboard, then paste it into a safe URL checker such as Google Safe Browsing or VirusTotal before visiting.

Are QR codes in emails always dangerous?

Not always, but they are increasingly used in attacks because they bypass link filters. Treat any emailed QR code with high suspicion, especially if it claims to be from Microsoft, Google, your bank, or HR. Legitimate services almost never require you to scan a QR code with a second device to log in.

Do iPhones or Androids offer better protection against quishing?

Both platforms show URL previews by default and warn about known malicious sites via Safe Browsing. iPhones have a slightly more locked-down app ecosystem, while Android offers more granular permission controls. The bigger factor is user behavior and keeping the OS and browser fully updated, not the brand of phone.

Should my business stop using QR codes to be safe?

No. QR codes are too useful to abandon. Instead, use a branded short domain so customers learn your real link, place codes in tamper-resistant locations, inspect them regularly, and publish a page showing your official codes. Pair this with phishing-resistant MFA on employee accounts and QR-specific awareness training.

Final Thoughts

QR code phishing is the natural evolution of social engineering: it hides a link behind a picture and relies on the speed of modern smartphones to turn curiosity into a click before caution kicks in. The good news is that the defenses are simple and almost entirely behavioral. Preview the URL, distrust unsolicited codes, never enter credentials on a page you reached by scan, and use a reputable branded shortener so your own audience can tell the real codes from the fakes.

Treat every QR code the way you treat a stranger offering directions: it is probably fine, but a two-second check costs you nothing and could save everything.