getsharesquare

Guide · 3 min read

QR code security: how quishing works and how to stay safe

By the GetShareSquare team · Updated

Short answer

Quishing is phishing through a QR code: a scammer gets you to scan a code that opens a fake login or payment page, or a malicious download. Check the web address your phone shows before opening it, be wary of codes in unexpected messages or stuck over other codes, and never pay or log in through a code you can't verify.

  • Look at the address your camera shows before you tap. Lookalike domains are the main trick.
  • Urgency plus a QR code ('your parcel is held', 'verify your account now') is a red flag.
  • On posters, meters and tables, check for stickers over the original code.
  • Businesses: inspect public codes regularly and print your web address next to them.

QR codes are trusted because they're everywhere: menus, parking meters, parcels, posters, payment terminals. That trust is exactly what scammers use. "Quishing", phishing with a QR code, swaps the suspicious link you'd never click for a black-and-white square you can't read by eye.

How QR code scams work

The attacks are old phishing tricks in a new wrapper:

  • Stickers over real codes. A fake code stuck on a parking meter, an EV charger, a restaurant table or a poster sends people to a lookalike payment page. The FTC's December 2023 alert used parking meters as its example.
  • Urgent messages with a code. An email or text says a parcel couldn't be delivered, an account will be locked, or a payment failed, and asks you to scan a code to fix it. Putting the link in an image can also slip past email filters that check links.
  • Fake login and payment pages. The code opens a site that looks like your bank, a delivery company or a work login, and captures whatever you type.
  • Malicious downloads. The code prompts you to install an app or open a file from outside the official app store.

The FBI warned in January 2022 that criminals were tampering with both digital and physical codes to redirect payments and steal login and financial information.

What to do as someone scanning

The FBI and FTC advice comes down to a few habits:

  1. Read the address before you open it. Phone cameras show the domain before you tap. Look for misspellings, extra words and odd endings: parking-citypay.com isn't your city council.
  2. Be suspicious of urgency. A code in an unexpected email or text that insists you act now is a classic phishing sign. Go to the company's site or app yourself instead.
  3. Look at the physical code. On meters, posters and tables, check whether a sticker has been placed over the original.
  4. Don't pay or log in through a code you can't verify. For payments, type the address you know or use the official app.
  5. Install apps only from your phone's app store, never from a link a code opens.
  6. Skip third-party scanner apps. Your camera already reads QR codes.
  7. Protect accounts anyway. Strong passwords, multi-factor authentication and an up-to-date phone limit the damage if something slips through.

If you think you've been caught, contact your bank straight away, change any password you entered, and report it: in the US to the FTC at ReportFraud.ftc.gov or the FBI's IC3.

What to do as a business putting codes in public

If you print codes that customers rely on, you're also the one who can spot tampering first:

  • Inspect public codes regularly. Check table tents, window posters and payment signs when you open. A second sticker or a slightly different code is a warning sign.
  • Print your web address next to the code. "Menu at yourcafe.com/menu" lets customers confirm the destination matches.
  • Use your own domain. A code to yourcafe.com/menu is easier to trust, and to check, than one to a string of random characters on a shortener.
  • Make tampering harder. Print codes as part of the sign rather than as a separate sticker, and put them behind glass or under a frame where you can.
  • Avoid taking payment through a code alone. If you do, make the payment page's address short and obviously yours, and tell customers what it should look like.
  • Never ask for passwords through a printed code. Customers should learn that a code is for menus and info, not for logging in.

Making codes that people can trust

Every code made with this generator is static: it contains exactly what you typed, and you can read it under "What's inside the code" before you download. There's no redirect through our servers, so nobody can change where your printed code goes later. Pair that with a domain you control and a short label, and you've given customers every reason to trust what they scan.

Sources

Questions

Can scanning a QR code hack my phone by itself?

Scanning only reads text. The risk comes from what you do next: opening a fake site and typing a password or card number, or installing an app or file from it. That's why checking the address before you open it matters.

Are QR codes made with free generators safe?

The code is only as trustworthy as its content. A static code made here contains exactly what you typed and nothing else; you can see it under 'What's inside the code'. The danger is codes made by someone else that point somewhere you didn't expect.

Should I use a QR scanner app?

The FBI advises against downloading third-party scanner apps, because the built-in camera on most phones already reads QR codes. Some scanner apps carry aggressive ads or worse.

More guides