Is that QR code safe to scan? How QR code phishing works
QR code phishing — called 'quishing' — is a fast-growing attack vector. Unlike a link in an email, a QR code hides its destination URL entirely until you scan it, bypassing many email security filters that check for malicious links. Scammers embed QR codes in phishing emails, print stickers over legitimate codes on parking meters and menus, and share them on social media.
Common scenarios: an email claims your Microsoft 365 or banking account requires verification and includes a QR code to scan with your phone; a sticker over a restaurant's menu QR code redirects to a card-skimming payment page; a parking meter has a fake payment QR code printed on a sticker placed over the real one.
The attack is particularly effective because scanning is typically done on a mobile phone, where URLs are less visible and security software is less prevalent than on desktops.
🚩 Red flags to watch for
- ▶A QR code in an email asking you to verify an account, confirm a payment, or complete a security check.
- ▶A QR code on a physical sticker that appears to be placed on top of or beside an existing official notice.
- ▶The URL that appears after scanning looks unfamiliar, has random characters, uses a URL shortener, or has a domain that isn't the company's real website.
- ▶The page the QR code opens asks for login credentials, credit card details, or personal information.
- ▶You were not expecting to receive a QR code from this sender or on this surface.
✅ What to do
- 1After scanning, always check the URL that appears before tapping to open it. If it looks unfamiliar or shortened, do not proceed.
- 2For physical QR codes (parking, restaurants, menus): look for stickers placed over printed codes — these are often slightly misaligned and can be peeled off.
- 3Use a QR code scanner app that shows you the full URL before opening rather than jumping directly to the page.
- 4Never enter credentials or payment details on a page reached via a QR code you weren't expecting.
- 5Report suspicious QR codes on parking meters or public property to the local authority or property owner.
📣 Where to report (by country)
🇺🇸 United States
🇬🇧 United Kingdom
- Action Fraud
- Police Scotland — call 101
🇦🇺 Australia
🇨🇦 Canada
🌍 Everywhere else
- Contact your local police and your bank immediately
- If money was sent, ask your bank about a recall request — act within hours
Got a suspicious message right now?
Paste it into our free AI checker for an instant pattern analysis
No account needed · Free to try · Privacy-first
Check your message free →No tool is a guarantee. AI pattern detection is a guide, not a verdict — always use your own judgment.
Common questions
Can a QR code itself install malware on my phone just by scanning?
Scanning a QR code alone does not install malware — it simply reads the encoded URL. The risk comes from what you do after the URL is revealed: visiting a malicious website and entering information, or being tricked into downloading an app from that site.
How can I tell if a parking meter QR code is fake?
Look for signs of a sticker placed over the original: raised edges, misaligned placement, or a slightly different finish. Some UK parking operators now include anti-tamper codes alongside QR codes. When in doubt, use the operator's official app or pay by phone using the number on the machine.