What Is Quishing? How QR Code Scams Work in 2026
Quishing hides phishing links inside QR codes you cannot read before scanning; here is how the scam works and how to stop it.
A QR code on a parking meter, a restaurant table or a parcel delivery text looks harmless. You point your phone, the camera opens a link, and you pay or log in. That convenience is exactly what scammers now abuse. “Quishing”, short for QR code phishing, hides malicious links inside codes you cannot read before scanning. Reports of these scams climbed through 2024 and 2025, and the FBI has warned the public to treat unexpected QR codes with suspicion. Here is how quishing works and how to stay safe.
Quishing is phishing delivered through QR codes. Attackers replace legitimate codes with their own or send them in emails and texts, so scanning takes you to a fake login or payment page that steals your details. Because phones do not show the destination before you tap, the scam is easy to miss. In January 2024 the FBI warned that criminals were tampering with QR codes to steal funds.
How a quishing attack works, step by step
Every quishing scam follows the same basic playbook. Understanding the sequence makes the red flags obvious.
- The attacker builds a malicious QR code. It points to a convincing fake: a parcel redelivery page, a bank login, a payment request, or a crypto wallet drainer. Free QR generators make this trivial.
- The code is placed where a QR code looks normal. A sticker is pasted over a parking meter code, a poster goes up in a cafe, or the code arrives in an email about a missed delivery or a text claiming a package fee is due.
- You scan it. Your phone camera shows a short preview link, often truncated, and most people tap through without reading it. Unlike a text link, the destination is unreadable to the human eye.
- The link opens the trap. It loads a page designed to harvest credentials or payment details, or it triggers a direct payment straight to the attacker’s account.
- The damage is done quietly. By the time you realise the page was fake, the credentials or money are gone, and the QR code that started it all reveals nothing about where it pointed.
Where quishing shows up in 2026
The FBI’s Internet Crime Complaint Center warned in January 2024 that criminals were tampering with QR codes to steal victim funds, describing cases where attackers replaced legitimate codes with their own. The pattern has only spread since: fake codes have turned up on parking meters, EV charging stations and restaurant tables. Read the FBI’s warning on QR code tampering for the official details.
Email remains the biggest channel. A message about a failed parcel delivery or an unpaid toll includes a QR code instead of a clickable link, which conveniently slips past many email security filters that scan text links. The FTC issued a consumer alert in December 2023 warning that scammers hide harmful links in QR codes to steal personal information, and that advice still holds.
Payment apps made the problem worse. Scan-to-pay flows in apps like PayPal, Venmo and Cash App normalised pointing your camera at a code and approving a transfer, so a doctored code at a market stall or inside a fake invoice feels routine. Crypto versions ask you to “verify” a wallet by scanning, then drain it. This is pure social engineering: the QR code is just the delivery method for an old-fashioned con.
Why email filters miss it
Most phishing detection scans URLs in message bodies. A QR code is an image, so the malicious link is invisible to text-based scanners. Some filters now decode QR images, but many still do not, which is why quishing emails reach inboxes that would block the equivalent text-link phish. Learning to spot a phishing email still helps, because the message wrapped around the code usually carries the classic warning signs: urgency, unexpected contact and a demand for action.
Red flags: legitimate QR code vs quishing attempt
Use this quick comparison before you scan anything unexpected.
| Situation | Probably legitimate | Treat as suspicious |
|---|---|---|
| Code placement | Printed on the official menu, meter or poster | A sticker placed over another code, or peeling at the edges |
| Preview URL | Shows the business’s real domain before you tap | Shortened link, odd domain, or no preview shown |
| What it asks for | Opens a menu or information page | Demands a login, payment or personal details immediately |
| How you received it | You sought it out yourself | Arrived unsolicited by text or email about a parcel, fine or toll |
| Pressure tactics | None | “Pay within 24 hours or else” urgency |
Protect yourself before and after you scan
Small habits defeat most quishing attempts. Make these automatic:
- Preview the URL every time. Both iPhone and Android show the link before opening it. Read the domain itself, not just the page title.
- Never scan QR codes from unsolicited texts or emails about deliveries, tolls or fines. Go to the official site or app directly instead.
- At payment points, check the code is part of the original signage, not a sticker layered on top of another code.
- If a scanned page asks you to log in, close it and open the service’s app or type the address yourself.
- Use a scanner that expands short links and flags known malicious domains, and keep your browser’s safe browsing protection switched on.
- If you already entered credentials, change the password immediately, sign out other sessions and check for unrecognised transactions.
AI-generated phishing pages now look pixel-perfect, so visual inspection alone is unreliable. Read our guide on AI phishing to understand what modern fakes look like and why old “spot the typo” advice no longer suffices.
Passkeys: the phishing-resistant upgrade
The strongest defence is to make stolen passwords useless. Passkeys, supported by Apple, Google and Microsoft, store a private key on your device and never reveal it to the site you are signing in to. According to the FIDO Alliance, this design makes passkeys resistant to phishing, because there is no password for a fake page to steal, even if you scanned a malicious QR code to reach it.
Enable passkeys on your email, bank and other high-value accounts, and keep a second factor on everything else. A quishing page can still trick you into approving a payment, so pair passkeys with the habit of verifying every unexpected payment request through a separate channel, such as calling the business on a number you already trust.
Frequently Asked Questions
Can my phone get a virus from scanning a QR code?
Scanning alone rarely infects a phone, because a QR code only encodes text, usually a URL. The danger is the page it opens: fake logins that steal credentials, or downloads of malicious apps from outside official stores. Keep your phone updated, never sideload apps from QR-linked pages, and treat every scanned link as untrusted until verified.
How can I tell where a QR code goes before scanning?
Your phone’s camera app shows a preview of the link before you tap it. Read the full domain carefully and watch for misspellings or URL shorteners hiding the destination. Dedicated scanner apps can expand short links automatically. If no preview appears, or the domain looks wrong, do not proceed.
Are QR codes in restaurants safe?
Usually yes, when the code is printed on the official menu or table card and only opens a menu page. Be cautious if the code is a sticker placed over another code, if it asks for payment details or a login, or if staff cannot confirm it is theirs. When in doubt, ask for a physical menu.
What should I do if I scanned a malicious QR code?
If you only opened a page and entered nothing, close it and clear your browser data. If you entered login details, change that password immediately and enable two-factor authentication. If you made a payment, contact your bank or card provider at once to dispute it, and report the scam to the FTC or your local authority.
Do QR code scams target businesses too?
Yes. Attackers send fake invoices, missed video-call notifications and MFA-reset messages containing QR codes to employees. Scanning one can hand over corporate credentials or enrol the attacker’s device in the victim’s authenticator flow. Businesses should train staff on quishing specifically and consider phishing-resistant MFA such as passkeys or hardware security keys.
Conclusion
Quishing works because it exploits a blind spot: you cannot read a QR code the way you can read a link. Attackers know this, and they hide fake logins and payment pages behind codes on meters, menus and in your inbox. The fix is a set of small habits: preview every link, distrust unsolicited codes, verify payment requests separately, and move your important accounts to passkeys so a stolen password is worthless. Treat every unexpected QR code as guilty until proven innocent, and this whole category of scam loses its power.
