QR Code Scams (Quishing): How to Scan Safely
QR codes are everywhere, from restaurant menus to parking meters. Because you cannot read the destination just by looking at one, criminals have started using them to send people to fake websites. This is called quishing, short for QR phishing.
How quishing works
- Stickers over real codes. A fake code is pasted over a genuine one on a parking meter or poster.
- Codes in emails and letters. A message claims you must scan to verify an account or reschedule a delivery.
- Fake payment pages. The code opens a lookalike login or payment page that steals details.
How to scan safely
- Check that the code is not a sticker placed over another one.
- Preview the link your phone shows before opening it and make sure it matches the company.
- Be wary of any code that asks you to log in or enter payment details.
- Use the official app for parking, banking and payments instead of scanning.
- Never scan a code from an unexpected email or message.
If you scanned a bad code
Close the page and do not enter anything. If you did, change the password for that account and for any other site where you used it, and tell your bank if you shared card details.
Key takeaway: Treat QR codes like links. Check where they lead before opening, and avoid entering passwords or payment details on a page you reached by scanning.
