A QR code scam, often called quishing, uses a QR code to send you to a fake website that steals passwords, card details or money. Because you cannot read a QR code by eye, scammers hide malicious links inside them. The best defence is simple: always check the link preview before you open it or pay.
QR codes are convenient, and that is exactly why criminals like them. Here is how quishing works and how to spot it.
What is quishing?
Quishing is a blend of "QR" and "phishing". Phishing is any trick that pretends to be a trusted organisation, such as a bank, delivery company or government office, to get you to hand over sensitive information. Quishing does the same thing, but delivers the fake link through a QR code instead of a clickable link.
This works for scammers for a few reasons:
- You cannot see the link. A QR code looks the same whether it leads to your bank or a fake copy of it.
- It moves you to your phone. On a small screen, it is harder to inspect the address bar or notice a slightly misspelled domain.
- It can slip past filters. Email and message filters are good at spotting suspicious links in text, but a link hidden in an image can be harder to catch.
- People trust QR codes. We scan them at restaurants and shops every day, so we rarely stop to think.
Consumer-protection agencies and banks in many countries have warned the public about QR code fraud, especially fake codes on parking meters, payment signs and in emails.
Where QR code scams appear
Quishing can turn up almost anywhere a QR code is expected. The most common places include:
- Stickers on public objects. A fake code stuck on top of the real one on a parking meter, EV charger, bike rental stand or bus stop.
- Payment counters. A replaced payment QR at a shop or market stall that sends money to the scammer instead of the merchant.
- Emails. Messages claiming your password is expiring, a document needs signing or your account is locked, with a QR code to "fix" it.
- Letters and parcel notices. Fake missed-delivery cards or official-looking letters asking you to scan and pay a small fee.
- Flyers and posters. Offers that seem too good to be true, such as free gifts or huge discounts, that lead to a fake shop or data-harvesting form.
- Social media and chat messages. Codes shared in groups or private messages, often with a sense of urgency.
For more detailed real-life scenarios, see our guide to common QR code scams.
Warning signs of a fake QR code
You do not need technical skills to spot most QR scams. Watch for these red flags:
- A sticker on top of another code. Run your finger over the code. If it feels raised, peels at the edges or looks newer than the sign around it, be suspicious.
- A link that does not match. The preview shows a domain that is not the organisation's real one, uses odd spelling, or is a long string of random characters.
- Urgency or threats. "Your account will be closed today" or "pay within one hour" is a classic pressure tactic.
- Requests for logins or card details. A parking meter, menu or parcel notice rarely needs your bank password.
- An app download you did not expect. Be very careful if a QR code asks you to install an app, especially from outside the official app store.
- A QR code in an email asking you to sign in. Legitimate services usually let you sign in by visiting their website or app directly.
- A wrong receiver name on payment. If the name shown in your banking app is not the shop you are paying, stop.
How to protect yourself from QR code scams
Good habits make quishing much less effective. Here is a practical checklist:
- Read the preview first. Your camera shows the link before opening it. Take two seconds to read the domain.
- Go direct when in doubt. Instead of scanning, type the company's website address yourself or open its official app.
- Check the receiver before paying. Banking apps show who will receive the money. Confirm it matches the business. Our guide to QR payment safety covers this in detail.
- Never enter passwords after scanning an unknown code. If a page asks you to log in, close it and sign in through the official app instead.
- Turn on two-step sign-in. Even if a password is stolen, an authenticator app adds a second barrier.
- Keep your phone updated. Security updates fix weaknesses that malicious pages might try to use.
- Use a scanner that previews safely. When you are unsure, scan the code with a tool that shows the destination before opening anything.
On QR-TH, every short link is checked against Google Safe Browsing when it is created and re-checked every night. Visitors can also see a loading page that shows where a link goes before it opens. Tools like these help, but they work best alongside your own judgement.
What to do if you scanned a fake QR code
If you realise you opened a suspicious page, act quickly but calmly:
- Close the page and do not enter anything further.
- If you typed a password, change it immediately on the real website, and anywhere else you used the same password.
- If you entered card or bank details, contact your bank straight away using the number on your card or in the official app.
- If you installed an app, uninstall it and run your phone's security check.
- Report the code to the business or venue so they can remove it, and to the relevant authorities if money was lost.
Our step-by-step guide on what to do after scanning a malicious QR code goes into more depth.
Tips for businesses
If you display QR codes, you can make life harder for scammers. Check printed codes regularly for stickers, train staff to notice tampering, and use dynamic QR codes on a domain you control so you can see scan statistics and update links quickly. Printing your business name next to payment codes also helps customers confirm they are paying the right person.
FAQ
Can scanning a QR code hack my phone?
Simply scanning a QR code does not hack your phone. The danger comes from what you do next: visiting a fake website, entering details or installing an app. Always check the link before opening it.
How can I tell if a QR code is fake?
Look for stickers placed over other codes, read the link preview carefully, and be suspicious of any page that asks for passwords, card details or urgent payment. If unsure, visit the official website directly.
Are QR codes in emails safe?
Treat them with extra caution. A QR code in an email asking you to sign in, verify an account or pay a fee is a common phishing trick. Go to the service directly instead of scanning.
Who should I report a QR code scam to?
Tell the business or venue where you found the code, contact your bank if money or card details are involved, and report it to your local police or consumer-protection authority.
Quishing relies on people scanning without thinking. A two-second pause to read the link is often all it takes to stay safe. Next time you are unsure about a code, use the QR-TH online QR scanner to see where it really goes before you open it.