QR Code Security: Quishing and How to Scan Safely

Not by itself. A QR code is a pattern that stores text. When your camera reads it, the phone shows you what is inside, usually a web address, and waits for you to tap. Other kinds of code ask first too: a WiFi code asks to join a network, a contact code asks to save a contact, an SMS code opens a pre-written message you still have to send.

The danger is what you open:

• A fake website that copies a bank, a parking service or a delivery company and asks for a password or card number.
• A malicious download, such as an app from outside the official app store.
• A rogue WiFi network, if a WiFi code was replaced with one for a hotspot the attacker controls.

Government warnings say a bad code can lead to malware; in practice that comes from the page or file the code opens, not from the pattern. Keeping your phone and browser updated closes the security bugs those pages try to use.

Quishing is phishing with a QR code in place of a clickable link. The FBI’s Internet Crime Complaint Center described the pattern in its public service announcement “Cybercriminals Tampering with QR Codes to Steal Victim Funds” (January 18, 2022), and the FTC followed with a consumer alert, “Scammers hide harmful links in QR codes to steal your information” (December 2023). The common forms:

• Stickers over real codes. A fake code is printed on a sticker and stuck over the genuine one on a parking meter, a sign or a restaurant table. It scans normally and leads to a lookalike payment page.
• Codes in emails and letters. A message claims a parcel could not be delivered, an account has a problem or a password must be changed, and asks you to scan. Email filters are good at checking links written as text; a link inside an image is harder for some of them to read, and scanning moves you from a protected work computer to your personal phone.
• Fake payment and login pages. The page looks like the real service, often with a domain that differs by a letter or a hyphen, and collects card numbers or passwords.
• Fake app downloads. The code offers an app “needed” to pay or park. The FBI advises downloading apps only from your phone’s official app store.

1. Read the preview. Check that the domain matches the organization you expect. Watch for extra words, hyphens and swapped letters.
2. Look at the code itself. On signs and meters, check whether it is a sticker on top of something else, or peeling at the edges.
3. Distrust urgency. “Your account will be closed” or “pay now to avoid a fine” is a pressure tactic.
4. Pay through the official app or website you already use, or type the address yourself, rather than paying through a code on public signage.
5. Never log in from a code in an email or a letter you were not expecting. Go to the site directly instead.
6. Install apps only from the official app store, never from a link in a code.
7. Use your phone’s built-in camera to scan. You do not need a separate scanner app, and the FBI warns against downloading one.
8. Ask before joining WiFi from a code in a public place. Confirm the network name with staff.

A short link is not a warning sign by itself, since many legitimate dynamic codes use one, but it hides the final destination. Be most careful when a short link asks for money or a password.

• Make tampering hard and visible. Print codes directly onto signs and menus rather than on stickers, put them behind acrylic or glass, and use tamper-evident labels where stickers are unavoidable.
• Check printed codes regularly. Add “scan every code” to opening or weekly checklists, and look for anything stuck on top.
• Print the destination under the code, for example “Opens yourcafe.com/menu”, so customers can compare it with the preview.
• Do not take payments through codes on public signage. Send people to your official app or a short, easy-to-type address.
• Watch for scan anomalies. With dynamic codes, a sudden drop to zero at one location can mean a sticker is covering your code. Scans from places you never printed it can mean it was copied.
• Protect the account that controls redirects. Whoever can sign in can repoint every printed code. Use a strong, unique password, two-step sign-in where your provider offers it, and as few shared logins as possible.
• Keep your domains renewed. A static code that points to a lapsed domain can be taken over by whoever buys it.
• Think about what the preview shows. A dynamic code shows the provider’s short link domain, not yours.

Scan tracking records data about the people who scan. What that means under privacy law is covered in QR codes and privacy under GDPR and CCPA, and how QR scan tracking works explains the numbers.

It depends on what happened after the scan:

• You only opened the page. Close it. The risk is low if you typed nothing and downloaded nothing; keep your phone updated.
• You entered a password. Change it from the real site or app, along with any account that uses the same password, turn on two-step verification and review recent activity.
• You entered card or bank details, or paid. Call your bank or card issuer on the number printed on your card, and ask them to block the card and dispute the payment.
• You installed something. Delete the app, check which apps have device administrator or profile access, and update the phone.

Then report it. In the US, file a complaint with the FBI at ic3.gov and the FTC at ReportFraud.ftc.gov. Tell the business or city whose code was covered, so they can remove the sticker before someone else scans it.