QR Code Phishing Scams: How to Stay Safe in 2026

QR codes have become part of daily life — on restaurant menus, parking meters, event tickets, product packaging, and even utility bills. But that same convenience has opened the door to a fast-growing threat: QR code phishing scams, often called quishing. Instead of tricking you with a suspicious link in an email, attackers hide the malicious URL inside a scannable image, bypassing many traditional security filters and your own instincts.

This guide explains how QR code phishing works, where it's showing up in 2026, how to spot the warning signs, and the practical steps individuals and businesses can take to stay safe.

What Is a QR Code Phishing Scam?

A QR code phishing scam is a social engineering attack where a criminal embeds a malicious URL inside a QR code to trick victims into visiting a fake website, downloading malware, or handing over credentials, payment details, or personal information. Because the destination URL is hidden inside a pixel pattern, victims can't easily tell where the code leads before scanning it.

The term "quishing" is a blend of QR + phishing, and it has exploded since 2023 as attackers realized that:

• Email security gateways often don't scan images for malicious URLs.
• People trust printed codes in public spaces without question.
• Scanning happens on mobile devices, which usually have weaker security than desktops.
• Mobile browsers show truncated URLs, making spoofed domains harder to detect.

How QR Code Phishing Actually Works

Most quishing attacks follow a predictable five-step pattern:

1. Create a lookalike landing page. Attackers clone a trusted brand's login page — Microsoft 365, a bank, a parcel delivery service, or a payment portal.
2. Generate a QR code pointing to that page. Often the URL is wrapped through a free shortener or a disposable domain to disguise it.
3. Distribute the code. This can happen through email attachments (PDFs with QR codes), stickers slapped over legitimate codes in public, posters, fake invoices, or even direct mail.
4. Victim scans with a phone. The browser opens the fake page, which looks identical to the real thing.
5. Credentials or payment data are captured and immediately used or sold.

Why Mobile Devices Make It Worse

Scanning happens on phones, and phones are a weaker defense environment than laptops. Address bars are short and hide subdomains. Corporate endpoint protection usually doesn't extend to personal devices. Users are also more distracted — scanning a code at a parking meter in the rain is not the moment anyone studies a URL carefully.

Real-World QR Phishing Scams to Know

1. Parking Meter Stickers

Cities across the US, UK, and Australia have reported fake QR stickers placed over legitimate payment codes on parking meters. Victims scan, enter card details into a convincing-looking "pay parking" page, and lose hundreds of dollars before noticing.

2. The Microsoft 365 "Expiring Password" Email

Employees receive an email claiming their password or multi-factor authentication is expiring. Instead of a link, there's a QR code to "re-verify your account on your phone." Scanning takes them to a fake Microsoft login that steals credentials — and often MFA tokens in real time.

3. Fake Delivery Notices

A "missed parcel" card is left at your door with a QR code to "reschedule delivery." The page asks for a small redelivery fee and full card details. The real goal is the card, not the fee.

4. Restaurant Menu Overlays

Attackers place a sticker over the real menu QR code at a cafe. Scanning leads to a page that pushes a malicious app download or a fake "tip and pay" portal.

5. Crypto Wallet Drains

QR codes posted in crypto communities or sent in DMs claim to connect your wallet for an airdrop. Instead, they trigger a transaction approval that empties the wallet.

Warning Signs of a Malicious QR Code

You cannot read a QR code with your eyes, but you can read the context around it. Watch for these red flags before and after scanning:

Warning Sign	Why It Matters
A sticker QR code placed over another code	Classic overlay attack — peel it back and the real code is often underneath
QR code in an unsolicited email, especially from "IT" or "HR"	Legitimate internal systems rarely require phone scanning for logins
URL preview shows a shortener or unfamiliar domain	Legit brands usually use their own domain for logins and payments
Landing page asks for password, card, or MFA code immediately	Credential harvesting is the whole point of the attack
Urgency language: "expires in 24 hours," "account suspended"	Pressure is a core social engineering tactic
Misspelled domain (micros0ft.com, paypa1.com)	Typosquatting is extremely common in quishing campaigns
No HTTPS padlock, or a certificate from a random issuer	Many throwaway phishing sites still skip or misconfigure TLS

10 Practical Ways to Stay Safe from QR Code Phishing

1. Preview the URL Before Opening It

Modern iOS and Android cameras display the destination URL as soon as a code is detected. Don't tap through automatically — read the domain first. If it doesn't match the brand you expect, stop.

2. Treat Public QR Codes with Suspicion

Codes on parking meters, posters, flyers, and tabletop stands are the easiest to tamper with. Where possible, pay or log in using the official app or by typing the known URL directly.

3. Physically Inspect the Code

Run your fingernail across the code. If it's a sticker on top of another sticker, that's a huge red flag — especially on parking meters, EV chargers, and payment terminals.

4. Never Enter Credentials from a Scanned Link

If a QR code takes you to any login page, close it and open the service manually from your bookmarks or app. This single habit defeats the majority of quishing attempts.

5. Use a Trusted Link Platform for Your Own QR Codes

If you create QR codes for your business — menus, business cards, product packaging — use a reputable link management platform that lets you update the destination, see scan analytics, and detect abuse. Services like Lunyb offer branded short links with QR code generation, so customers see a recognizable domain in the preview instead of a random string. You can compare options in our 2026 URL shortener buyer's guide.

6. Enable Phishing-Resistant MFA

Hardware security keys (FIDO2/WebAuthn) and passkeys cannot be phished via a fake login page, because they verify the real domain cryptographically. Even if you scan a bad code and type your password, the attacker still can't log in.

7. Keep Your Phone's OS and Browser Updated

Many quishing attacks chain into browser exploits or malicious app installs. Patched devices block most of these payloads automatically.

8. Use Encrypted DNS or a Protective DNS Service

Services like Cloudflare 1.1.1.1 for Families, NextDNS, or Quad9 block known phishing domains at the network level before your browser can even load them. This works across all apps on your phone, not just the browser.

9. Verify by a Second Channel

If a QR code supposedly comes from your bank, employer, courier, or utility company, call them using a number from their official website — not from the message that contained the code.

10. Report Suspicious Codes

Report quishing attempts to your IT team, the brand being impersonated, and local authorities (Action Fraud in the UK, FTC in the US, Scamwatch in Australia). Reports lead to takedowns that protect everyone else.

How Businesses Should Defend Against Quishing

Organizations are the biggest targets because a single stolen employee credential can unlock an entire corporate environment. A layered defense works best.

Email and Collaboration Platform Controls

• Enable email security that performs OCR on images and QR codes to extract hidden URLs for scanning.
• Block or quarantine inbound emails containing QR codes from external senders, or at minimum flag them with a warning banner.
• Disable automatic URL expansion from unknown shorteners in webmail previews.

Identity and Access Controls

• Roll out passkeys or FIDO2 security keys for all staff — this is the single most effective defense.
• Enforce conditional access policies: block logins from unmanaged devices or unusual locations.
• Shorten session lifetimes so stolen tokens expire quickly.

Awareness and Training

• Run simulated quishing campaigns alongside traditional phishing simulations.
• Teach employees the "scan, don't tap" rule — read the URL before opening.
• Make it easy to report suspicious codes with a one-click button or a known email address.

Protect Your Own Brand

If your business uses QR codes in marketing, printed materials, or packaging, protect customers by:

1. Using a branded short domain so the preview URL is recognizable (e.g., links.yourbrand.com).
2. Monitoring for typosquatted domains that could be used in fake QR campaigns against your customers.
3. Publishing a help page explaining what your legitimate QR codes look like and where they appear.
4. Using a link platform with analytics so you can detect unusual scan patterns. We cover trusted options in our honest Lunyb review and Rebrandly review.

What to Do If You've Already Scanned a Malicious QR Code

If you suspect you've fallen for a quishing attack, act quickly. The faster you respond, the less damage attackers can do.

1. Disconnect from the internet if you installed any app or file from the scanned link.
2. Change passwords for any accounts you entered credentials for — starting with email, then banking, then everything else that shared that password.
3. Revoke active sessions in each affected account's security settings.
4. Contact your bank if you entered card or payment details. Freeze the card and request a new one.
5. Enable or re-enroll MFA, ideally with a passkey or hardware key.
6. Run a mobile security scan and remove any apps installed in the last 24 hours that you don't recognize.
7. Report the incident to your IT team (if work-related) and to your national cybercrime reporting body.
8. Monitor your credit for the next few months and consider a credit freeze if sensitive identity data was exposed.

The Future of QR Phishing

Expect quishing to get more sophisticated. AI-generated landing pages now clone brands pixel-perfectly in minutes. Dynamic QR codes can change their destination after being printed, meaning a code that was safe when quality-checked can be weaponized a week later. And as more services push "scan to pay" and "scan to sign in" flows, user fatigue will make bad codes blend in with good ones.

The defense isn't to stop using QR codes — they're genuinely useful. The defense is to build the habit of previewing before tapping, using phishing-resistant authentication, and treating any code that leads to a login or payment page with healthy skepticism.

Frequently Asked Questions

Can simply scanning a QR code infect my phone?

In almost all cases, no. Scanning a QR code only reveals a URL or text — it doesn't execute code by itself. The danger comes from what you do next: opening the link, entering credentials, or installing an app the page recommends. Keeping your OS updated protects you against the rare cases where a malicious page tries to exploit a browser vulnerability.

How can I tell if a QR code sticker has been tampered with?

Look for a sticker placed on top of another sticker, bubbles or wrinkles in the surface, misaligned edges, or a code that looks newer or glossier than the surrounding signage. On parking meters and payment terminals, legitimate codes are usually printed directly onto the device, not stuck on with adhesive.

Are QR codes in emails always dangerous?

Not always, but they should always be treated with extra caution. Legitimate business workflows rarely require you to scan a code with your phone to log in to a desktop service. If an email asks you to do this, verify through another channel — call the sender, check your account directly, or contact your IT team.

What's the safest way to generate QR codes for my own business?

Use a reputable link management platform that offers branded short domains, HTTPS by default, scan analytics, and the ability to update destinations if something goes wrong. Avoid random free generators that bake in their own tracking domain, since customers may not recognize the preview URL. Our URL shortener comparison breaks down the best options.

Do mobile security apps actually help against quishing?

They help, but they're not a complete solution. Good mobile security suites block known phishing domains, warn about suspicious app installs, and scan downloads. However, they can't stop you from typing your password into a brand-new fake login page that hasn't been reported yet. Combine them with phishing-resistant MFA (passkeys or hardware keys) for real protection.