Why QR codes are attractive to scammers
A QR code hides its destination. With a printed web address you can read the domain before you visit; with a QR code you see a pattern of squares and have to trust whoever put it there. Scammers exploit that gap, and the technique has a name: quishing, QR phishing.
QR codes are not themselves dangerous. Scanning one does not install anything or give a website access to your phone. The danger is the same as any phishing link: being taken to a convincing fake page and persuaded to type in a password, card number or one-time code, or to download something.
Law enforcement and consumer agencies have warned about this repeatedly. The FBI's Internet Crime Complaint Center issued a public service announcement in January 2022 about criminals tampering with QR codes to redirect victims to malicious sites, and the US Federal Trade Commission published a consumer alert about scammers hiding harmful links in QR codes in December 2023.
The common scams
Stickers over legitimate codes. The best-documented version targets parking payments. Fraudsters print their own QR codes and stick them over the real ones on pay stations or parking signs. The fake site looks like a parking payment page and collects card details. Several US cities found fraudulent stickers on parking pay stations in early 2022, and similar warnings have since been issued in the UK, Europe and Australia. The same trick works on restaurant table codes, EV chargers and bike-share docks.
QR codes in phishing emails. An email claims your password is expiring, a document is waiting for your signature, or your multi-factor authentication needs resetting — and asks you to scan a code rather than click a link. The code is there deliberately: links in emails are scanned by security filters, but a link inside an image often is not. Scanning with your phone also moves you from a managed work laptop to a personal device with weaker protection.
Fake delivery and payment notices. A card through the letterbox or a flyer on a windscreen claims a missed delivery, an unpaid fine or a refund, with a QR code to "resolve" it.
Payment redirection. A QR code for a bitcoin address or a bank transfer is swapped for one encoding the scammer's details. Crypto payments in particular cannot be reversed.
Malicious WiFi codes. A code labelled as a venue's guest WiFi actually joins a network the attacker controls, letting them observe unencrypted traffic and present fake login pages.
Checks before you scan
Look at the code itself. Is it a sticker on top of something printed? Are its edges lifting? Is it slightly misaligned with the sign's design? Run a finger over it. A sticker on a parking meter is a reason to pay another way.
Read the address before opening it. Both iPhone and Android show the destination before opening it — iOS displays the domain in a banner at the bottom of the camera view. Read it:
- Does it match the organisation? A city's parking payment will not be on
parking-pay-secure.example. - Is it a lookalike? Watch for swapped or added letters, hyphens, unusual top-level domains and brand names buried in subdomains such as
yourbank.account-verify.example. - Is it a URL shortener? Legitimate businesses do use them, but a shortener hides the real destination. Be more careful.
Be suspicious of anything that rushes you. A fine that will double, an account that will be locked, a parcel that will be returned — urgency is the scam's lever.
Never enter credentials or card details on a page reached by an unsolicited QR code. If an email says your account needs attention, close it and go to the service directly through its app or a bookmark.
Pay through official apps where possible. If your city has a parking app, use it rather than a code on a sign.
If you think you scanned a malicious code
- Do not enter anything. If you only opened the page, close it; simply visiting is low risk on an up-to-date phone.
- If you entered a password, change it immediately on the real site, and anywhere else you reused it. Turn on two-factor authentication.
- If you entered card details, call your bank using the number on your card and ask them to block it.
- If you downloaded something, delete it and run a security scan. On Android, check for unfamiliar apps with accessibility or device-admin permissions.
- Report it — to the business or council whose code was tampered with, and to your national fraud reporting service.
For businesses: protect the codes you print
If customers scan your codes, you are a target too. A scammer who stickers over your table codes is stealing from your customers in your name.
- Make tampering visible. Print the code as part of the design rather than as a separate sticker, so an overlay is obvious. Place it under a laminated or glass cover where possible.
- Print your domain next to the code. "Scan to order at yourcafe.example" lets customers check the address their phone shows against what you printed.
- Use your own domain, not a third-party short link. Customers can recognise your name; they cannot recognise a random redirect domain.
- Inspect regularly. Add "check the QR codes" to the opening checklist for anything in public view: tables, windows, chargers, meters.
- Never ask for passwords or full card details on a page reached by scanning. Use a proper payment provider's hosted checkout.
- Prefer static codes for anything long-lived. A dynamic code adds a third party whose account can be compromised or whose redirect can be changed. See do QR codes expire? for the trade-offs.
Is it safe to use an online QR code generator?
It depends on what the generator does with your data. A generator that renders codes in your browser never receives what you type. Qrfast.io works that way: your WiFi password or bitcoin address never leaves your device. You can verify it in your browser's developer tools by watching the Network tab while generating a code.
A generator that issues dynamic codes necessarily stores your destination on its servers and sits between your customers and your content on every scan. That is not inherently unsafe, but it is a dependency you should choose deliberately.
Frequently asked questions
Can scanning a QR code hack my phone?
Scanning a code on its own cannot install software or take control of an up-to-date phone. The risk comes from what you do next: entering passwords or card details on a fake site, or downloading an app or file the page offers.
What is quishing?
Quishing is phishing using QR codes. The code leads to a fake site designed to steal logins or payment details. It is often used in emails because security filters inspect links in text more thoroughly than links hidden inside images.
How can I check where a QR code goes before opening it?
Point your camera at it and read the link preview your phone shows before tapping. On iPhone the domain appears in a banner; on Android, Google Lens and most camera apps show the full URL. Check the domain carefully for lookalike spellings.
Are QR codes on parking meters safe?
Official ones are, but parking meters are the most common target for sticker scams. Check that the code is not a sticker on top of the sign, confirm the domain matches the city or operator, and prefer the operator's official app.
Should I scan QR codes in emails?
Be very cautious. Legitimate services rarely need you to scan a code from an email to reset a password or sign a document. Go to the service directly instead of scanning.
Further reading
- Do QR codes expire? — A QR code itself never expires — but a dynamic code can die when a subscription ends. How to tell which kind you have, and how to get an editable code without the risk.
- GS1 Digital Link: QR codes on products, explained — How GS1 Digital Link puts a product's GTIN, batch and expiry into a QR code that both checkouts and phones can read, what Sunrise 2027 means for brands, and how to build one correctly.
- How QR codes work, from pattern to payload — A clear technical walkthrough of a QR code: the finder and timing patterns, how text becomes bits in each encoding mode, Reed–Solomon error correction, masking, and how a phone reads it.
- How to scan a QR code on any device — Scan QR codes with the built-in camera on iPhone and Android, from a screenshot or photo, on a Windows or Mac computer — and what to do when a code will not scan.