Quishing: How QR Code Phishing Works and How to Scan Safely

Quishing is phishing through a QR code. Instead of a suspicious link, the scammer gives you a code to scan, on a sticker stuck over a parking meter’s real one, in an email, on a flyer or in a letter, and the code opens a fake payment or login page. Before you enter anything after scanning, check the web address your phone shows, and when you’re paying for something, use the official app or website you find yourself rather than the code.

QR codes are everywhere, from restaurant menus to parking lots, so scanning one feels routine. That’s exactly what makes quishing work. If you scanned a fake code and paid, you haven’t done anything unusual, and there are clear steps to take now.

What quishing is and why scammers use QR codes

The name combines QR and phishing. It’s the same trick as a phishing email or scam text, with the link hidden inside a code. That gives scammers a few advantages:

• You can’t read a QR code by looking at it. With a normal link you can at least see the address. A code hides it until you scan.
• It moves you to your phone. Codes in emails push you from a computer, where security tools may be stronger, to a phone with a smaller screen where the address is harder to check.
• It can slip past filters. An email containing an image of a code may not be flagged the way a suspicious link would be.
• Physical codes borrow real trust. A sticker on a city parking meter looks official because the meter is official.

The FTC has warned consumers about QR codes in unexpected texts, emails and on public signs, and several US cities have reported fake QR code stickers on parking meters and pay stations.

Common quishing scams

Where you see it	How it typically works
Parking meters and pay stations	A sticker placed over or next to the real code leads to a fake parking payment site that collects your card details.
Emails	A message says you need to reset a password, sign a document, set up two-factor authentication or view a voicemail by scanning a code. The code leads to a fake login page.
Letters and packages	A notice or unexpected package includes a code for “delivery”, “billing” or a “gift”, leading to a phishing site. See our package delivery scam guide.
Texts and messages	A code sent as an image in a text or chat, often with a delivery or payment story. See smishing.
Flyers and posters	Codes on flyers for discounts, events, jobs or charity drives lead to fake sign-up or donation pages.
Payment requests	Someone buying or selling online sends a code to “receive” money, which actually authorizes a payment or opens a fake app login.

Warning signs of a fake QR code

• It’s a sticker on top of something. Look for codes stuck over another code, with raised edges or a slightly different color from the sign around it.
• The web address doesn’t match. After scanning, your phone usually shows a preview of the address. A parking payment site that isn’t the city’s or the operator’s known domain is a red flag.
• It asks for more than it should. A parking page asking for your full date of birth, or a “document” asking for your email password.
• It came unexpectedly, especially in an email about account security or a letter you weren’t expecting.
• Urgency. Pay now to avoid a ticket, verify within the hour, your account will be locked.
• It asks you to download an app from a link rather than from your phone’s official app store.
• The sign itself looks official but the code is the only way to pay. Real parking systems usually list an official app name, website or phone payment option too.

How to scan a QR code safely

1. Look at the code before scanning. Check for stickers, tampering or a code that seems out of place.
2. Use your phone’s built-in camera, which usually shows the destination address before opening it. Avoid third-party scanner apps unless you trust them.
3. Read the address. Look at the main domain (the part just before the first single slash) and check it matches the organization. Watch for misspellings and extra words.
4. Don’t sign in or pay from a code you didn’t expect. Go to the site or app yourself instead.
5. Don’t scan codes from unexpected emails about passwords, documents or account security. Sign in the way you normally would and check for any notice there.
6. Never scan a code to receive money. Receiving payments doesn’t require scanning a stranger’s code.

Our guide on how to check if a website is legit has more ways to judge a page once it’s open.

What to do right now if you scanned a fake QR code

Scanning alone usually doesn’t harm your phone. The risk comes from what you entered or downloaded. Work through what applies.

1. Close the page and don’t enter anything more.
2. If you entered card details, call your card issuer on the number on the back of your card. Ask them to block the card, send a new one and flag any charges you didn’t make.
3. If you entered a password, change it on the real site straight away and anywhere else you used it. Turn on two-factor authentication. If it was a work account, tell your IT team, since codes in emails often target work logins. Our my account was hacked guide has account-by-account steps.
4. If you downloaded an app, delete it, run a security scan and check which permissions it had.
5. If it was a parking payment, check with the city or parking operator through its official site or app whether your parking was actually paid, so you don’t also get a ticket.
6. Take a photo of the fake code and where it was, and screenshot the web address and any payment receipt.

When you call your bank, you can say:

I scanned what turned out to be a fake QR code on a parking meter and entered my card details on the website it opened. Please block this card, issue a replacement and let me dispute any charges I don’t recognize.

Where to report a quishing scam

• The owner of the real sign or meter. For fake parking stickers, report them to the city or parking operator through its official website or phone line so they can remove them and warn others. Don’t try to peel off stickers yourself if it means handling a damaged meter.
• ReportFraud.ftc.gov for any QR code scam.
• The FBI’s IC3 (ic3.gov) if you lost money online.
• Your email provider’s report phishing option if the code came by email, and your IT team for work mail.
• Forward to 7726 if the code came by text.
• The company being impersonated, through its official website.
• Local police, particularly for physical stickers in public places, since tampering with public equipment may interest them.

For every route in one place, see how to report a scammer.

Getting your money back

Most quishing scams collect card details, and card payments are usually the easiest to dispute. Call your card issuer as soon as you notice, explain that you paid on a fraudulent website, and ask for a dispute on any charges. Keep the photo of the code and your receipt as evidence.

If the scam led you to send money through a payment app, bank transfer, gift cards or crypto, report it to the provider right away. Those payments are often hard or impossible to reverse, but acting quickly gives you the best chance. Anyone who contacts you afterward offering to recover the money for a fee is likely running a recovery scam.

Worked example: the parking lot sticker

This is an illustrative scenario, not a real person. Elena parks downtown and sees a sign on the pay station reading “Scan to pay”. She scans it, and her phone opens a page with a parking logo asking for her plate number and card details. She pays.

That evening she notices two unfamiliar charges on her card. She goes back through her photos, finds the one she took of her parking spot and realizes the pay station also listed an official parking app, which she hadn’t used. She calls her card issuer, which blocks the card and opens a dispute. She reports the sticker to the city through its official website and at ReportFraud.ftc.gov. The next time she parks, she downloads the official app from her phone’s app store and pays there.

For businesses: protect your own QR codes

If your business uses QR codes on tables, windows, receipts or marketing, a scammer can place a sticker over them. That can cost your customers money and leave them blaming you.

• Check your printed codes regularly for stickers or tampering, especially outdoors.
• Print the destination address near the code so people can compare it with what their phone shows.
• Use your own domain rather than a generic shortener, so the address looks recognizably yours.
• Offer another way to pay or order, so customers aren’t forced to trust a code.

If you use a code to ask for reviews, our guide to the Google review QR code covers setting one up safely. If customers were scammed through a fake code at your location and are posting about it, our review management team can help you reply clearly and calmly.

Common mistakes to avoid

• Assuming a code on an official sign is official. The sign may be real while the sticker isn’t.
• Skipping the address preview. It’s the one chance you get to see where the code leads.
• Signing in to work accounts from an emailed code. Real IT teams rarely require this.
• Waiting to call your bank. The sooner a card is blocked, the less a scammer can charge to it.

Frequently asked questions

What is quishing?

Quishing is QR code phishing: a scam that uses a QR code, on a sticker, email, letter or flyer, to send you to a fake website that steals your card details, login or money.

Can scanning a QR code hack my phone?

Scanning a code on its own generally doesn’t infect an updated phone. The risk comes from what you do next: entering card details or passwords on the page, or downloading an app it offers.

How do I know if a parking meter QR code is fake?

Look for a sticker placed over the original, check that the web address matches the city or parking operator, and use the official parking app or website instead when one is listed.

What should I do if I paid through a fake QR code?

Call your card issuer using the number on your card to block it and dispute the charges, report the fake code to the sign’s owner and at ReportFraud.ftc.gov, and check your real account or parking status through official channels.