You scan QR codes without thinking, and that is precisely the point. At a parking meter, on a restaurant table, on a parcel slip, in a message from a delivery company, a QR code promises a shortcut: point your phone, tap once, and you are paid, ordered, or logged in. Nobody stops to inspect a black-and-white square the way they would inspect a suspicious email link, because there is nothing to inspect. A QR code cannot be read by eye, and that invisibility is what scammers are exploiting.

The scam has a name: quishing, QR code phishing. A scammer replaces a real code with their own, or sends you a code in a message you did not expect, and the code opens a fake login page, a fake payment page, or a download that installs malware. The US Federal Bureau of Investigation warned as early as 2022 that criminals were tampering with QR codes to steal login and financial information, and the Federal Trade Commission followed with its own warning about fake codes on parking meters. Since then the trick has spread from meters to menus, packages, emails, and payment requests. This guide explains how quishing works, where fake codes hide, how to check a code in five seconds before you scan, and what to do if you have already scanned one.

Ordinary phishing gives you a chance. A dodgy email link sits in plain text, and a careful reader can spot a misspelled domain, a strange sender, or an urgent tone that does not fit. A QR code removes that chance entirely. The destination is encoded in a pattern no human can read, so your only inspection happens after your phone has already decoded it, in the half-second before you tap. Scammers do not need to write a convincing email. They only need you to trust a square.

Trust is the second ingredient. QR codes feel official because businesses use them everywhere, and we have been trained to treat them as a convenience, not a risk. A code printed on a meter, stuck to a table, or printed on a delivery slip borrows the authority of the place it sits in. You assume the parking authority put it there, or the restaurant, or the courier. A scammer only has to borrow that assumption for a few seconds, long enough for you to scan and pay.

Speed is the third ingredient. Most QR scams add urgency once the page loads: an account that will be locked, a fine that must be paid today, a parcel held until you confirm details, a prize that expires in an hour. Urgency exists to stop you doing the one thing that would defeat the scam, which is to close the page, open the official app yourself, and check. Every step in this guide is designed to slow that moment down, because a slower scan is a safer scan.

The most reported trick is the sticker over a real code. Scammers print their own QR code as a sticker and press it over the legitimate code on a parking meter, a payment kiosk, a restaurant table, or a public sign. You scan what looks like the meter's code and land on a fake payment page that collects your card details. Cities in several countries have warned about exactly this in 2026, after drivers reported fraudulent charges within minutes of paying at a meter, and in some cases the authority involved did not use QR payments at all.

The second hiding place is your inbox and your messages. An unexpected email, text, or chat message carries a QR code and a plausible story: verify your account, reschedule a delivery, claim a refund, or view a document. Because the code hides the link, the usual phishing clues are invisible, and security filters that check text links may not check the image at all. Any QR code in a message you did not ask for deserves the same suspicion as an unexpected link.

The third is the parcel and the package slip. Some scams arrive as an unsolicited package, or a slip left at your door, with a QR code to scan for tracking, a return, or a gift. The FBI warned in 2025 about unsolicited packages carrying QR codes that lead to phishing sites or malware downloads. If you did not order it, do not scan it to find out what it is. Go to the retailer's own site or app and check your orders there instead.

The fourth is the payment request. A seller, a stranger, or a fake support agent sends a QR code to pay, often for a bargain, a bill, or a supposed fee. Real payment codes exist, and legitimate businesses use them, which is why the fake ones work. The danger is that a payment code can point to the scammer's account, not the business's, and a payment made that way is often impossible to reverse, especially with cryptocurrency or instant-transfer apps.

The fifth is the fake app download. A code promises a parking app, a menu app, a loyalty app, or a video, and instead downloads an app from outside the official app store, or a lookalike app that steals passwords and messages. Never install an app from a QR code alone. Find the app yourself in your phone's official store, check the developer name and reviews, and install it from there.

The sixth is the public Wi-Fi or login code. A code in a cafe, hotel, or shared workspace promises free Wi-Fi or a quick login, and instead routes you through a fake captive portal that captures your credentials or your payment details. If a venue offers Wi-Fi, ask staff for the network name and confirm it matches what your phone shows, rather than trusting a printed code on its own.

Before your phone comes out, look at the code itself. Legitimate codes on meters, signs, and menus are usually printed directly onto the surface, or sealed under laminate as part of the design. A fresh sticker sitting on top of a printed sign, slightly crooked, peeling at a corner, overlapping a border, or covering a different code underneath, is the single clearest warning sign. Run a finger lightly over the edge if you can: a sticker feels different from print, and a second layer is often obvious to touch.

Next, compare it with its neighbours. On a row of parking meters, a set of restaurant tables, or a wall of signs, the real codes should all look the same size, in the same place, printed the same way. One code that is larger, smaller, off-centre, or printed on different paper from the rest was probably added later. That comparison takes two seconds and catches the laziest, and most common, version of this scam.

Then check for context. Is there a plain-text web address, a business name, or instructions printed beside the code? Legitimate signs usually tell you where the code goes, or at least which service it belongs to. A bare code with no explanation, on a surface where it does not belong, or in a place where the business would normally use a card machine rather than a code, is worth a second thought. When in doubt, ask a member of staff, use the card machine, or pay through the official app you already have installed.

Your phone's built-in camera is your best defence, because it shows you the destination before you open it. On iPhone, open Camera and point it at the code; a banner appears with the web address. On Android, the same happens in the Camera app or in Google Lens. Read that address before you tap, every time. Do not use a random third-party scanner app if your camera already does the job, because a scanner app adds another company between you and the link, and some free scanners show ads or collect data of their own.

What you are looking for is a mismatch. Does the domain match the business you expect? A parking payment should go to the city or the parking operator, not to a random domain with extra words, numbers, or hyphens. Watch for lookalike domains: one letter changed, a familiar name with an extra word such as secure, verify, or payment added, or a completely unrelated domain. A shortened link, such as a bit.ly or tinyurl address, is also a warning, because it hides the final destination in exactly the same way the QR code does.

Two cautions matter here. First, a padlock and https do not prove a site is genuine. Anyone can get a security certificate for a fake domain, so https only means the connection is encrypted, not that the site belongs to who it claims. Second, dynamic QR codes, the kind businesses use so they can change the destination without reprinting, route through a redirect service first, which makes the preview less useful on its own. In that case, judge the page that finally loads: does the branding, spelling, and contact information match the real business, and does it ask you for something the real service would not ask for at this step?

For payments, the safest rule is simple: use the app you installed yourself, not the page a code opens. If you pay for parking regularly, install the official parking app from your app store before you need it, and open it directly. A sticker cannot change an app already on your phone. The same applies to banks, delivery companies, and restaurant chains. If a code is the only way to pay and you cannot verify it, choose another payment method: the card machine, the counter, or cash.

For menus and ordering, a QR menu should only show you a menu. If scanning a restaurant code takes you to a login page, asks for your card before you have ordered anything, or asks you to download an app to see the menu, stop. A real menu does not need your password or your payment details to show you the food. Close the page, ask staff for a printed menu, or search for the restaurant's own website yourself.

For logins of any kind, never log in from a scanned code you did not expect. If a code takes you to a login page for your email, bank, social account, or work system, close it and log in through the official app or by typing the address yourself. Your password manager, if you use one, adds a quiet second check here: it will only autofill on the genuine domain, so if it refuses to fill, that refusal is information, not an annoyance. Treat an unexpected login screen after a scan as a red flag, not a routine step.

One more habit closes most of the remaining gap. After you scan, before you type anything, ask yourself three questions: did I expect this code, does the address match the business I expect, and does this page need my password or card right now? If any answer is no, close the page. A genuine service will still be there when you reach it through its own app or website, and a scammer's page will not.

Urgency is the most reliable red flag. Messages such as your account will be locked in ten minutes, pay this fine today or it doubles, or your parcel will be returned unless you confirm now, are designed to push you past the checks in the previous sections. Real parking operators, banks, and delivery companies do send reminders, but they do not need you to act from a single scanned page within minutes, and they will always let you check the same information in their official app.

The second red flag is a request that does not fit the task. A parking page that asks for your email password, a menu page that asks for your card number, a delivery page that asks for your bank login, or any page that asks for a one-time code from your authenticator app, is not the real service. One-time codes are the keys to your accounts, and no legitimate business asks you to type one into a page you reached from a QR code.

The third red flag is a download or a permission grab. A page that insists you install an app, enable notifications, allow access to your contacts, or turn off a security setting before you can continue, is trying to get a foothold on your phone. Close it. The fourth is sloppy impersonation: a logo that looks slightly off, text with spelling mistakes, a contact page with no real address or phone number, or a payment page that only accepts cryptocurrency or gift cards. Any one of these is enough reason to stop.

Do not panic, and do not try to undo it on the same page. Close the browser tab or the app immediately, and do not enter anything else. If you only scanned and previewed the link without tapping or typing, you are almost certainly fine; scanning alone, without opening a malicious page or downloading anything, does not hand over your passwords. The risk starts when you logged in, paid, or downloaded something.

If you entered a password, change it right away, but do it properly: open the official app for that service, or type its address yourself, and change the password there, not through any link from the scanned page. If you use the same password anywhere else, change those too, starting with your email, because email resets unlock everything else. Turn on two-factor authentication with an authenticator app if it is not already on, and check the account for new devices, forwarding rules, or changed recovery details.

If you paid, contact your bank or card provider as soon as you can and explain that the payment went to a fraudulent page. Ask about a chargeback and about blocking the card if the details were entered on a fake site. If you sent cryptocurrency, contact the exchange or wallet provider, but be honest with yourself that recovery is unlikely; that irreversibility is exactly why scammers prefer it. Keep screenshots of the page, the code, and the transaction, and keep the receipt, because your bank and any report will ask for them.

If you downloaded an app from a scanned code, delete it, then run a security scan with your phone's built-in protection, such as Google Play Protect on Android, and check which permissions the app held before you removed it. If anything feels wrong afterwards, such as new messages sent from your accounts or logins you do not recognise, treat it as a compromised device and change your important passwords from a different, clean device. Finally, report it: the FTC at reportfraud.ftc.gov, the FBI's Internet Crime Complaint Center at ic3.gov, and, for a fake code in a public place, the business or authority whose code was copied, so they can remove the sticker before the next person scans it.

QR scams work best on people in a hurry, and that includes children, older relatives, and anyone who has only recently started using a smartphone for payments. The five-second check in this guide is easy to teach: look for a sticker, read the preview, never log in from a surprise code, and use the official app instead. Show someone once, on a real meter or menu, and the habit tends to stick, because it is physical and quick, not technical.

If you run a small business and use QR codes for menus, payments, or reviews, protect your own codes as well. Print them as part of your signage rather than as loose stickers, check them regularly for tampering, and tell customers where the genuine code should take them, for example by printing your web address beside it. A customer who knows your real domain is a customer who will notice a fake one. If you use dynamic QR codes that redirect, keep the redirect service under your own account and review where it points at least once a month.

At home, one rule covers the package and message versions of this scam: never scan a code to find out what an unexpected delivery or message is about. If a parcel arrives that you did not order, or a message claims a delivery problem, check your orders in the retailer's own app, or contact the retailer through the number on its official site. Curiosity is the attacker's best tool here, and the official app is the boring answer that defeats it.

Before you scan: look for a sticker over a printed code, check the code matches its neighbours, and ask whether you expected this code at all. When you scan: use your phone's built-in camera, read the full preview address before you tap, and watch for lookalike domains and shortened links. After it loads: never log in or pay from a surprise code, never type a one-time code into a scanned page, never download an app a code insists on, and prefer the official app you installed yourself for any payment or login.

If something feels off at any step, stop, and reach the service another way. That single habit, reaching the business through its own app or a typed address instead of through the code in front of you, defeats almost every version of quishing, because the scam only works if the code is your only route in. QR codes are genuinely useful, and there is no need to stop using them. Just give every code the same five seconds you would give a suspicious link, and most fake codes will never get past you.