Quishing: QR Code Scams and How to Spot Them
A QR code cannot install anything, run anything, or take money by itself. Everything it can do to you happens after you tap the link — which is precisely why the attack is so effective, and why the defence is so simple.
What a QR code can actually do
A QR code is text. That is the whole of it. The pattern of squares decodes to a string of characters, and everything that follows is your phone deciding what to do with that string.
So a code cannot, by itself:
- Install an app. Both iOS and Android require an explicit install action from the store.
- Take a payment. Opening a payment app still requires you to confirm.
- Run code on your phone, access your files, or read your messages.
What it can do is put a convincing web page in front of you, or pre-fill a message, or hand your phone a WiFi network to join. The danger is entirely in what you do next — and the reason QR phishing ("quishing") works is that the usual defence against phishing, look at the link before you click, is exactly what a QR code removes.
The attacks that work
The sticker. By far the most common. A printed sticker with a different code goes over the real one on a parking meter, an electric-vehicle charger, a restaurant table card, a public transport poster or a charity collection sign. The victim scans what looks like an official code and lands on a convincing payment page. Physical, cheap, and it needs no technical skill at all.
The lookalike domain. The code resolves to something like parking-city-pay.com or my-bank-verify.net — plausible at a glance on a small screen, especially since mobile browsers truncate long URLs.
The redirect chain. The code contains a shortener link that forwards through several hops. The final destination is invisible at scan time, and can be changed after the codes are printed or posted. This is a specific hazard of dynamic codes: the printed square is not a promise about where you will end up.
The fake invoice or delivery notice. A letter or an email with a code "to pay the outstanding balance" or "to reschedule your delivery". The QR code exists in these to get you off your monitored work computer and onto a personal phone.
The rogue WiFi code. A WiFi code joins your phone to a network chosen by whoever printed the card. Rarer, because it requires the attacker to be physically present, but real in cafés and hotels.
Three checks before you tap
These take about five seconds between them.
- Look at the physical code. Is it a sticker on top of something? Does it have a lifted edge, a mismatched finish, a slightly different white? Legitimate codes are usually printed as part of the sign, not stuck on afterwards. If you can catch an edge with a fingernail, do not scan it.
- Read the URL preview before tapping. Both iPhone and Android show the destination in a banner or notification before opening it. Read the domain — the part immediately before the first single slash.
pay.cityname.gov.uk/parkingis the city.cityname.gov.uk.pay-portal.netis not; the real domain there ispay-portal.net. - Never enter credentials or card details on a page you reached by scanning. If a code takes you somewhere asking for a password or a payment, close it and reach the same service the way you normally would — type the address, or use the app you already have. This one check defeats almost every version of the attack.
Two habits worth adding. Be suspicious of any code that arrives with urgency attached — a fine to pay today, an account to verify within 24 hours. And treat unsolicited codes on paper mail with the same scepticism you would give an unexpected email link, because they are the same thing.
If you print codes for a living
The sticker attack is a problem for whoever owns the sign, not just the victim, so a few countermeasures are worth knowing:
- Print the code as part of the artwork, not as a label applied afterwards. A code that is clearly part of the printed surface is much harder to cover convincingly.
- Print the destination in readable text beside the code. "This code opens example.com/menu". It gives people something to check against, and it makes a substituted sticker obvious.
- Use your own domain. A code pointing at your own short path is verifiable at a glance; one pointing at a third-party shortener is not, and trains your customers to accept unverifiable links.
- Check your codes physically, on a schedule. Anything unattended in public — a table card, a poster, a charger — should be looked at, not just assumed.
- Never ask for payment or login through a scanned code if you can avoid it. You are teaching customers a habit that will be used against them.
If you already scanned one
Scanning alone is almost never the problem. Work through what happened after:
- You only opened the page. Close it. There is realistically nothing to do; a web page cannot compromise a patched phone by being viewed.
- You entered a password. Change it now, on the real site, and anywhere you reused it. Turn on two-factor authentication if it is not already on.
- You entered card details. Call your bank, freeze the card. Do not wait to see whether anything happens.
- You installed something. Remove it, and on Android check that no app has been granted accessibility or device-admin permissions.
- You joined a WiFi network. Forget the network in settings. Anything you did over it in the meantime should be treated as observed.
And if the code was a sticker over an official one, tell whoever owns the sign. They usually have no idea, and the sticker is still there for the next person.
Written by Manuel Llovet, who builds and maintains QR Code Free Forever. Published 2026-08-31, last checked 2026-09-08. Figures and measurements on this page were produced for this site; the method is described in each caption.