Quishing: Malicious QR Codes
'Quishing' uses QR codes — on stickers, flyers, packages, or emails — to send you to fake sites that steal payment or login details, or to malware.
Think a message like this reached you? You can check it right now.
What this scam is
A QR code is just a link you can't read with your eyes, which makes it a handy disguise for scammers. They place fraudulent QR stickers over real ones (on parking meters, EV chargers, restaurant tables), mail 'unexpected package' or 'you won' flyers with QR codes, or embed them in phishing emails. Scanning takes you to a fake payment or login page, or prompts a malicious download. Previewing the link before opening, and paying through official apps rather than random QR codes, defeat it.
What it usually looks like
- A QR code you're urged to scan to pay, log in, or claim something.
- A sticker that looks added over an original code.
- QR codes in unexpected mail, flyers, or emails.
- A page after scanning that asks for card/login.
Common warning signs
- QR codes leading to non-official payment/login pages.
- Stickers applied over legitimate codes.
- Unexpected QR codes in mail/email.
- Requests for card or login after scanning.
Example wording scammers use
“Scan to pay / scan to claim your prize / scan to verify your account.”
“(After scanning) 'Enter your card and login to continue.'”
These are illustrative examples written by ScamSplain, not real messages.
What the scammers want
- Your card or login on a fake page.
- To install malware.
- To exploit the trust in QR convenience.
What to do
- Preview the link a QR opens before proceeding; check the web address.
- Pay through official apps rather than scanning random codes.
- Inspect codes for tampering; be wary of QR in unexpected mail/email.
- Don't enter card/login on a page reached only by a QR scan.
What to do if you already responded
- Call your card issuer and dispute charges; change any login you entered.
- Scan your device if you downloaded anything.
- Report at reportfraud.ftc.gov.