QR code scams (quishing): how they work and how to stay safe

A QR code is not dangerous in itself, because it only holds text, usually a web address. The risk is where it sends you and what you do when you get there. Before you scan a code in public, check that it has not been stuck over another one. After scanning, read the address your phone shows before you open it. Never enter a password or card number on a page you reached from a code you did not expect.

• Sticker overlays: a fake code stuck over a real one on a parking meter, a restaurant table, a poster or a charging station.
• Emails and letters: a message that says your account, parcel or payment has a problem and asks you to scan a code to fix it. Because the link is hidden in a picture, some email filters cannot read it.
• Fake codes on flyers and posters that promise a prize, a discount or a free download.
• Codes that open a payment page or ask you to log in to an account, copying a company’s real login screen.

The pattern is always the same: a reason to hurry, a code instead of a link, and a page that asks for something valuable.

• The code looks like a sticker placed over something else, or its edges are lifting.
• The address your phone shows does not match the business, or is a long string of letters and numbers, or uses a lookalike spelling.
• You were not expecting it: an unprompted message with a deadline or a threat.
• The page asks for your password, a one-time code, your card details or your bank login straight away.
• It asks you to install an app that is not from your phone’s official store.

1. Look at the physical code first. If it is a sticker over another code, do not use it.
2. Scan, then read the address before you tap it. Your phone camera shows it. The QR code scanner on this site shows you what the code holds and leaves opening any link to you.
3. Go to the company’s own website or app by typing the address yourself, rather than using a code, for anything involving money or accounts.
4. Do not log in or pay from a page you reached through an unexpected code.
5. Turn on two-factor authentication for important accounts, so a stolen password alone is not enough.
6. If an email asks you to scan a code, contact the sender through a number or address you already know.

Scanning alone is usually harmless. What matters is what you did next. If you entered a password, change it on the real site at once, and anywhere else you used it. If you entered card details, call your bank using the number on your card. If you installed something, remove it and run your phone’s security check. You can report the scam to your national consumer protection agency. In the United States, that is the FTC at ReportFraud.ftc.gov.

You can make your own codes easier to trust. Print the web address in plain text under the code so people can see where it goes. Point the code at a domain you own, so there is no third-party address in the middle. Keep codes in places you control, and check them from time to time for stickers placed over them. A static code made with QRCraftly holds your address itself, so there is no middleman server that could be switched or compromised. Why a code stops working explains why that matters.

• U.S. Federal Trade Commission, “Scammers hide harmful links in QR codes to steal your information”, consumer.ftc.gov (December 2023)Fake codes can lead to harmful pages; check the address before opening and be wary of codes in unexpected messages.
• FBI Internet Crime Complaint Center, “Cyber Criminals Tampering with QR Codes to Steal Victim Funds”, ic3.gov (January 2022)Criminals replace legitimate codes with tampered ones that lead to credential and payment theft.