QR Code Scams (Quishing)

Quishing is phishing delivered through a QR code. Because a QR code is just a picture, it sails past filters that would catch a suspicious link, and it hides the destination until you have already scanned it. Reports have climbed roughly fourteen-fold in five years, helped along by how normal it now feels to point a phone at a square and pay.

How It Works:

• The Sticker: The simplest and most common version. A scammer prints QR stickers and applies them over the genuine codes on parking meters, EV chargers, parking-lot signs, restaurant tables, and charity collection boxes. You scan what looks like official signage and land on their payment page.
• The Fake Notice: A code arrives by text, email, or physical mail claiming an unpaid toll, a held package, a parking fine, or an overdue utility bill. Printed letters work especially well because paper still feels official.
• The Harvest: The page is a convincing copy of a real payment or login screen. It takes your card number, or your bank credentials, or asks you to install an app.
• The Follow-Up: Some codes do not ask for payment at all. They capture enough personal detail to support a later phone call, in which someone who knows your address and your recent "parking fine" sounds entirely credible.

Key Red Flags:

• A QR sticker with edges you can feel, sitting slightly crooked, or covering something underneath. Run a thumbnail over it.
• An unsolicited code in an email, text, or letter, especially one that replaces a link that would normally be there.
• A scanned link that goes to a shortened URL, or to a domain that is not the organization's real website.
• A parking or charging sign where the code is the only way to pay and there is no listed phone number or app name.
• A code that asks you to install an app from outside the official app stores.

How to Protect Yourself:

• Read the URL before you open it: Both iPhone and Android show the destination as a preview banner when you scan. Take the extra second to read the domain, not just the page title.
• Pay through the official app or website instead: For parking, tolls, and charging, use the operator's own app or type its address in yourself. You will almost never need the sticker.
• Treat a code in unsolicited mail as hostile: No toll authority or delivery company needs you to scan a code to resolve a debt. Look the organization up separately and check your account there.
• Inspect the physical code: If it is a sticker on top of another sticker, do not use it, and tell the business or the operator.
• Never enter credentials on a page you reached by scanning: Navigate to the site yourself and log in there.

Quishing is a delivery method rather than a scam in its own right, so the destination is usually a phishing page or the opening move in a bank impersonation scam. Fake toll codes are close cousins of text message scams.