Quishing — QR phishing — is a scam where a QR code sends you to a fake payment page, login form or download instead of the real destination it imitates. Because a QR code hides its link until you scan, the defence is simple: preview the link, check the domain, and never enter passwords or card details after an unexpected scan.
What quishing is and why it works
A QR code is nothing more than a shortcut: a pattern of dots that encodes a piece of text, usually a web address. Your phone decodes that text and offers to open it. The problem is that you cannot read dots with your eyes, so you never see where a code leads until it is already on your screen.
Scammers exploit two things. First, habit: scanning a menu, a parking sign or a poster feels routine, and routine means people stop thinking. Second, borrowed trust: a code printed on a wall, a letter or an invoice looks official, even though anyone with a free generator can produce one in seconds. The word quishing simply combines "QR" and "phishing" — the same tricks used in fake emails, delivered through a square sticker instead.
The most common quishing scams
Fake stickers over real codes. The classic version targets pay-by-phone parking. A scammer prints their own QR code on a sticker and places it over the genuine one on a parking meter or sign. Drivers scan it, land on a convincing copy of the payment site, enter their card details, and the money — and the card data — goes to the scammer. The same trick appears on EV chargers, bike and scooter rentals, restaurant tables, donation posters and collection tins.
Codes in emails and letters. A QR code inside an email is usually an image, so text-based spam filters have less to read. Paper letters work the same way: "your account will be closed", "your parcel could not be delivered", "you are owed a refund — scan to claim". The letter format adds authority; the QR code hides the link.
Urgent payment demands. Many quishing messages push the same buttons as ordinary phishing: a fine that must be paid now, a delivery held at a depot, a suspended account. Urgency exists to stop you from checking.
A scan can also do more than open a page. Depending on its content, it can open a payment app with the recipient pre-filled, add a contact or calendar entry, start a download, or connect your phone to a Wi-Fi network. Each of those can be abused.
Preview the link before you open it
Most modern phones show the destination as a banner or notification when you scan with the built-in camera — nothing opens until you tap it. Treat that preview as the whole ball game: read it every time, even when you are in a hurry.
On many phones you can long-press the preview to expand the full web address, which is worth doing whenever a link looks shortened or odd. If a scanner app opens the browser automatically, or starts a download without asking, replace it. A scanner that always shows the link first — the free one on QRCodeMax.Vip works this way — puts the decision back in your hands.
One more habit: for anything involving money or logins, skip the scan entirely and open the official app or type the address you already know. A QR code is a convenience, never a necessity.
How to check a domain in a few seconds
A web address has one part that matters: the domain, the words immediately before the first single slash. In pay.meters.example.com, the domain is example.com. In example.com.meters-pay.info, the domain is meters-pay.info — the "example.com" at the front is decoration. Scammers count on people reading left to right and stopping at the familiar word.
Then look for lookalikes: a zero where an "o" should be, "rn" standing in for "m", extra hyphens, or a familiar brand name glued onto an unrelated ending. Legitimate organisations keep a small set of payment domains; a parking sticker pointing at a domain you have never seen is reason enough to stop.
If the domain means nothing to you, do not pay, do not log in, do not download. Close the page.
Distrust urgency — and never enter credentials after an unexpected scan
Urgency is the loudest red flag. Real fines, real deliveries and real account problems do not expire in thirty minutes, and no genuine organisation needs your password in a hurry. Any message that threatens a fine, a clamp, a lost parcel or a closed account unless you scan and pay immediately should be treated as hostile until proven otherwise.
The rule that protects you from nearly every quishing outcome: after an unexpected scan, never enter a password, a card number or a one-time code. It is fine to look at the page; it is not fine to type. If you genuinely owe for parking or a bill, pay through the app or website you normally use, not the one a sticker handed you.
Before confirming any payment a scan opened, check the recipient's name and the amount — QR payments can arrive pre-filled, and the scam is in the pre-filling. And never install an app or grant permissions because a QR code asked you to.
Spotting tampered stickers and suspicious placements
Physical scams leave physical clues. Before scanning a code in public, give it a two-second look:
- Edges lifting, bubbles, or a sticker sitting on top of a printed label
- Print that is sharper, blurrier or a different colour from the sign around it
- A code placed where it has no reason to be, such as a payment code on a lamppost
- A sticker that covers part of the original text or another code
Compare the code with any web address printed next to it in plain text; a mismatch is a clear warning. If something looks off, do not scan it — pay another way and report the tampering to the operator, using the phone number printed on the machine or sign, never one the sticker itself provides.
Use a scanner that shows the link first
Your phone's built-in camera is usually the right tool: it previews the link and does not install anything by itself. Whatever scanner you use, three features matter. It should show the destination before opening anything, it should never auto-download files, and it should come from a source you trust rather than an unknown app store listing.
Keep your phone's operating system and browser up to date as well; modern browsers recognise many known phishing pages and will warn you. That safety net helps but is not a guarantee — a fake page on a fresh domain can look identical to the real one, which is why reading the domain matters more than any tool.
If your business uses QR codes
Every code you print is a promise, and a swapped sticker turns it into an attack on your customers. A few habits keep that promise intact:
- Assign each physical code an owner and check the high-risk ones — parking, payments, unattended machines — on a regular schedule.
- Use managed or "dynamic" QR codes that point through a short, consistent domain you control, so a compromised destination can be changed or switched off in minutes instead of requiring every poster to be reprinted.
- Print the destination domain in plain text beside every code. Customers can then verify where a code leads, and a sticker covering that text is immediately suspicious.
- Avoid random short links that hide the destination; if you shorten, use your own domain.
- Place codes where staff can see them or protect them with a tamper-evident casing, and treat any code on an unattended outdoor surface as a standing risk.
- Tell customers how you will and will not ask for payment, and train staff to treat QR codes in emails with the same suspicion as links.
Finally, check periodically that every published code still resolves to the page it should. Discovery by a customer is the worst way to learn about a swap.
The key takeaway
A QR code is just a link in disguise, so treat it exactly as you would treat a link from a stranger: preview it, read the domain, refuse urgency, and never enter passwords or card details after an unexpected scan. Two seconds of pause before you tap defeats nearly every quishing scam.