QRJiffy

QR Code Scams: How to Spot Quishing

A QR code sticker on a parking payment post at a street car park
Parking payment posts are a common target for fake QR stickers — check the link preview before you pay. Photo: GKANSHUM Mindao · CC0 · Wikimedia Commons

A QR code scam (quishing) hides a phishing link inside a QR code, so the victim cannot read the address before scanning. Scammers place fake codes on parking meters, in emails, on parcels and over restaurant menus. Checking the decoded URL before opening it stops most attacks.

Updated · QRJiffy team

What is quishing?

Quishing is phishing that uses a QR code instead of a clickable link to deliver a malicious website. The code hides the URL from the eye and from many email filters, which scan text links but not images. The FBI’s Internet Crime Complaint Center (IC3) issued a public service announcement in January 2022 warning that criminals tamper with QR codes to redirect victims to sites that steal login and financial information.

Where do fake QR codes appear?

Fake QR codes appear in 5 common places: parking meters, emails, parcels and letters, restaurant tables and public posters. Each one uses a different pretext:

  • Parking meters and EV chargers: a sticker over the real code leads to a fake payment page.
  • Emails: a “reset your password” or “sign this document” message shows a QR code to bypass link scanning.
  • Parcels and letters: unsolicited deliveries include a code that promises a gift or a missed-delivery fee.
  • Restaurant tables: a sticker over the menu code collects card details for a fake order.
  • Posters and flyers: job offers, giveaways and crypto “airdrops” lead to credential or wallet-draining pages.

How do you check a QR code before opening it?

Read the full decoded URL before tapping it, and open nothing that fails the 5 checks below. iPhone and Android cameras show the domain in a banner; a QR code scanner that decodes without opening shows the complete address.

  1. Read the domain from right to left: in paypal.com.secure-login.io, the real domain is secure-login.io.
  2. Reject misspellings such as paypa1.com or arnazon.com.
  3. Treat link shorteners (bit.ly, tinyurl and similar) on payment codes as a warning sign.
  4. Reject http:// pages that ask for passwords or card numbers.
  5. Type the official website yourself for anything involving money or logins.

How do you spot a tampered physical QR code?

A tampered code is usually a sticker placed over the original, so raised edges, misalignment and mismatched print quality give it away. Run a finger over the code. Compare it with the rest of the sign’s printing. On parking meters, the city’s official app or the meter keypad is the safer route.

Are payment QR codes a scam risk?

Yes, payment QR codes are a scam risk when the payee name does not match the business you intend to pay. UPI, Venmo, PayPal and Cash App all show the recipient name before the payment is confirmed. Stop if the name differs from the shop or person in front of you. Never scan a code to “receive” money: receiving needs no action from you. The payment QR code generator page explains how each provider displays the payee.

What should you do if you scanned a scam QR code?

Close the page, change any password you entered and contact your bank if you entered card details. Then take these steps:

  • Enable two-factor authentication on the affected accounts.
  • Do not install any app or configuration profile the page offered.
  • Report the code to the venue owner, the city (for parking meters) or the platform it imitated.
  • In the United States, file a report at ic3.gov.

How do businesses protect their QR codes from tampering?

Businesses protect QR codes by printing them into the material, using a branded domain and checking them regularly. Printed or engraved codes are harder to cover than stickers. A code that opens your own domain is easy for customers to verify. Laminated table tents and tamper-evident labels show interference. Staff checks on public signage catch overlays early.

Are QR codes that use a short link riskier?

A short-link code adds one risk: if the QR service account is compromised, the destination changes with no visible sign on the print. Protect the account with a strong password and two-factor sign-in, and scan your printed codes regularly. Do QR codes expire? covers the other trade-off.

Where can you check what a QR code contains before printing?

QRJiffy shows the encoded data under every code before you download it. Create a QR code now and test-scan it with the QR code scanner.

Frequently asked questions

Are QR codes safe to scan?

Yes, scanning a QR code is safe on its own; the risk comes from the link or action it opens. A phone camera shows the destination first, so check the domain before tapping.

Is the QR code generator legit?

A legitimate generator shows the exact content inside the code and states its plan limits before you download. Scan the downloaded code and check that it opens your intended link.

What is QRishing?

QRishing, also called quishing, is phishing delivered through a QR code. The code sends the victim to a fake login or payment page that steals credentials or money.

Is it safe to scan a QR code to receive money in your bank account?

No, you never need to scan a QR code to receive money. Payment QR codes send money from the person scanning; a stranger asking you to scan one to “receive” funds is a scam.

How to check scammer QR code?

Decode the code without opening it, then read the full URL. Look for misspelled brands, extra words in the domain, link shorteners and http instead of https.

When a QR code is scanned, where does it go?

A QR code goes wherever its stored content points: a web address, a phone number, a WiFi network or plain text. Codes that hold a QR service’s short link go first to that service, then to the final destination.

Sources

  1. Cybercriminals tampering with QR codes to steal victim funds (PSA I-011822-PSA) — FBI Internet Crime Complaint Center
  2. Scan a QR code with your iPhone camera — Apple Support
  3. Digital payment education — Zelle