FreeurlYou scan a QR code on a parking meter, a package slip or an email, and your phone opens a page asking you to log in or pay. If that page was set up by a scammer, you just handed over your details. That is quishing, and this post covers what is quishing and how to avoid it, in plain steps you can use today.
The short answer: treat a QR code like a link someone handed you on a slip of paper. Look at where it goes before you trust it, and never type a password or card number into a page you reached from an unexpected code.
What is quishing?
Quishing is "QR phishing." A scammer puts a malicious web address inside a QR code instead of writing it out as a clickable link. When you scan it, your phone opens that address.
The trick works because a QR code is just a picture. You cannot read the address by looking at it. Email filters also have a harder time checking a picture than a text link, which is one reason scammers like the format. A German e-banking phishing campaign reported by BleepingComputer swapped buttons for QR codes in spam emails for this reason.
The code itself is harmless. The danger is the page it opens: a fake login screen, a fake payment form, or a download that tries to install something on your phone.
How do scammers use QR codes?
The Federal Trade Commission describes the common patterns in its December 2023 consumer alert. Three show up again and again:
- Stickers over real codes. Someone covers a legitimate QR code, such as one on a parking meter or a restaurant table, with their own.
- Codes in messages. A text or email says a package could not be delivered, your account has a problem, or you must change your password. A QR code is the "fix."
- Urgency. The message pushes you to act fast, so you scan before you think.
The FBI raised similar concerns in a January 2022 public notice. It warned that criminals swap legitimate payment QR codes for ones that send victims to malicious sites, which can steal login and financial details, install malware or redirect payments to the attacker's account.
We cover the sticker case in detail in How to Spot a Fake QR Code Sticker (7 Checks).
A worked example
Say you get a text: "We missed your delivery. Scan the QR code to reschedule." You are expecting a package, so it feels plausible.
Here is how to handle it. First, ask whether the sender is one you know. A real carrier does not need a QR code in a text. Second, skip the code and open the carrier's app or type its website yourself. Third, enter your tracking number there. If the delivery is real, you will see it. If it is not, nothing shows up, and you have lost nothing.
That is the FTC's advice in practice: if a message might be real, contact the company using a website or phone number you already know is genuine.
How to avoid quishing: a 5-step routine
- Ask if you expected it. A code you did not ask for, especially one tied to money, a delivery or your account, is a red flag.
- Preview the address before opening. Most phone cameras show the web address when they read a code. Tap it only after you read it. Look for misspelled names, extra words, or odd endings.
- Check short links. Many QR codes point to a shortened link, which hides the final destination. Paste it into an unshorten tool to see where it really leads without opening it.
- Do not log in or pay from a scanned page. If a code asks for a password or card number, close it and go to the company's site by typing the address yourself.
- Look at the physical code. If it is a sticker on a meter, sign or poster, check that it is not placed over another code or peeling at the edges.
Also keep your phone's operating system updated and turn on multi-factor authentication for important accounts. The FTC recommends both. Multi-factor authentication will not stop you from visiting a fake page, but it makes a stolen password far less useful.
Why a preview is not enough on its own
Here is an honest limit. Reading the address helps, but scammers can register domains that look almost right, such as one letter swapped or a brand name followed by extra words. A quick glance can miss that. And if the code uses a short link, the preview shows only the short domain, not the real destination.
So the preview is one layer. The stronger habit is the one in the example above: do not act on an unexpected request through the code at all. Go to the source on your own.
Our guides Are Short Links Safe? 7 Checks Before You Click and How to Check a Bit.ly Link Before You Click It go deeper on checking links of any kind.
What if you already scanned one?
Scanning alone usually does nothing. The risk comes from what you do next. Here is what to do, based on how far you went:
- You only opened the page: Close it. Do not tap anything else. You are probably fine.
- You typed a password: Change that password right away on the real site, and on any other site where you used it. Turn on multi-factor authentication.
- You entered card or bank details: Call the number on the back of your card or on your bank's real website and report it.
- You installed an app or file: Delete it and run your phone's security scan. If you are unsure, get help from your carrier or the phone maker.
You can also report scams to the FTC at ReportFraud.ftc.gov. That helps others, even if you lose nothing.
If you print QR codes for your business
Quishing is also your problem if you use QR codes on flyers, menus or packaging. A customer who scans a fake sticker placed over yours may blame you.
A few habits help. Check printed codes in public places on a schedule. Use a short link on your own domain so customers can see your brand when the address previews. You can set that up with your own domain for short links. And track scans so a sudden change stands out; see How to Track QR Code Scans.
One trade-off: a branded link makes your code look more trustworthy, but it cannot stop someone from pasting a sticker over it. Physical checks still matter. Freeurl can help you manage and watch your links, but it cannot inspect a sticker in the real world.
Frequently asked questions
Can scanning a QR code hack my phone?
Scanning on its own rarely does. Harm usually comes after, when the page asks for a login, a payment or an app install. Opening the page and closing it without entering anything is generally low risk.
How can I see where a QR code goes before I open it?
Point your camera at it and read the address preview before tapping. If the address is a short link, paste it into an unshorten tool to see the final destination first.
Are QR codes in emails safe?
Treat them with extra care. Scammers use codes in emails because filters check images less well than text links. If an email asks you to scan a code to log in or pay, go to the company's website directly instead.
What should I do if a QR code is stuck over another one?
Do not scan it. Tell the business or the owner of the meter or sign, and pay or log in through their official website or app.
Frequently asked questions
Can scanning a QR code hack my phone?
Scanning on its own rarely does. Harm usually comes after, when the page asks for a login, a payment or an app install. Opening the page and closing it without entering anything is generally low risk.
How can I see where a QR code goes before I open it?
Point your camera at it and read the address preview before tapping. If the address is a short link, paste it into an unshorten tool to see the final destination first.
Are QR codes in emails safe?
Treat them with extra care. Scammers use codes in emails because filters check images less well than text links. If an email asks you to scan a code to log in or pay, go to the company's website directly instead.
What should I do if a QR code is stuck over another one?
Do not scan it. Tell the business or the owner of the meter or sign, and pay or log in through their official website or app.