QR Code Scams: 10 Ways to Spot and Avoid Quishing

QR code scams, often called "quishing", hide a harmful link inside a QR code, so you can't see where it goes until you scan. The common ones are fake stickers over real codes on parking meters and shop counters, codes in urgent emails and texts, and UPI codes that ask you to "scan to receive" money. The defence is simple: read the link your phone previews before opening it, and never enter a PIN, password or card details after scanning a code you didn't expect. If you make codes yourself with the free QR code generator, there are also ways to make yours harder to fake.

As per the US Federal Trade Commission (consumer alerts, December 2023 and September 2026), scammers place their own codes over legitimate ones and send codes in messages that create a sense of urgency, so people scan without thinking. The same tricks turn up worldwide.

1. Read the link before you open it

When you point your camera at a QR code, most phones show a small preview of the link before opening it. Stop and read it:

• Is it the domain you expect? A parking payment should go to the parking operator's or city's site, not a random address.
• Look for look-alikes: swapped letters (rn for m), extra words (yourbank-secure-login.example), or odd endings.
• Be wary of shortened links that hide the real destination, in places where you'd expect an official address.

If the preview doesn't match what the code claims to be, don't open it.

2. Watch for stickers on top of stickers

Run a finger over a printed code in a public place. A sticker stuck on top of another code, a slightly misaligned label, or a code that looks newer than the sign around it are warning signs. This is common on parking meters, EV chargers, bike rentals and restaurant tables.

When in doubt, pay through the operator's official app or website, which you open yourself, or ask staff.

3. Never scan to receive money on UPI

This is the most common QR trick in India. Someone answers your online ad for a used sofa, or claims to be refunding you, and sends a QR code saying "scan this to receive the payment". Scanning a UPI code and entering your PIN always sends money. You never need to scan a code or enter your UPI PIN to receive money.

The same rule applies to any request that ends in entering your PIN: if you're supposed to be getting money, stop. The guide to UPI QR codes explains how genuine payment codes work.

4. Be suspicious of QR codes in emails and texts

Messages that say "your parcel couldn't be delivered", "suspicious activity on your account" or "your password expires today, scan to keep access" are classic quishing. A QR code in an email also gets around some email link scanners, because it's an image.

If you think the message might be genuine, don't scan. Open the company's app, or type its website address yourself, and check your account there.

5. Never sign in or pay right after scanning

A QR code that opens a login page or payment form is a high-risk moment. Ask yourself whether you expected to log in or pay right now. If you didn't, close it. If you did, check the address bar shows the real website, with the correct spelling, before typing anything.

Turning on two-step sign-in for your important accounts means a stolen password alone isn't enough. See password tips for families for how to set this up for everyone at home.

6. Decode suspicious links before visiting

Some scam links hide their real destination in a jumble of % codes, such as %2F and %3A. If your phone shows a long, messy link, copy it without opening it and paste it into the free URL decoder to see it in plain text. Redirect parameters like ?url= or &redirect= followed by another web address show where you'd really end up. The guide to decoding UTM and tracking links explains what the pieces mean.

7. Don't install apps from QR codes

A code that opens an app download outside the official app store, or asks you to allow installs from unknown sources, is a red flag. Install apps only from your phone's official store, and search for them yourself rather than following a scanned link.

8. Keep your phone updated

Updates fix security holes that malicious pages might use. Turn on automatic updates for the operating system and your browser. It's a small habit that protects you from the scams you don't spot.

9. If you run a shop, protect your codes

Customers trust codes on your counter, so scammers target them:

• Use stands or laminated cards that are hard to cover with a sticker, and check them daily.
• Print your shop name and UPI ID or web address next to every code, so customers can match what their phone shows.
• Confirm payments in your own app, never by looking at the customer's screen.
• Label each code clearly ("Pay here", "Menu", "Review us"), so a stray sticker stands out.

When you make codes with the free QR code generator, they're created on your device and point straight to your link, with no third-party redirect that someone else controls. The comparison of static vs dynamic QR codes explains why that matters.

10. Know what to do if you've been caught

Act quickly:

1. Money sent by UPI or card: call your bank immediately using the number on your card or in the official app, and ask them to block and dispute the transaction.
2. Report it. In India, call the national cyber crime helpline 1930 or report at the government's cyber crime portal. In the US, report to the FTC. Other countries have similar fraud reporting services.
3. Password entered on a fake page: change that password everywhere you used it, and turn on two-step sign-in.
4. App installed: uninstall it, run your phone's security check, and change important passwords from a different device.

Speed matters: the sooner the bank knows, the better the chance of stopping the money.

Make honest codes

QR codes are useful and mostly safe; the risk is in codes you didn't expect. If you need one for your shop, event or home, make it with the free QR code generator and print your web address beside it so people can check where it goes. See how to make a QR code for the basics.