QR code scams (quishing): the sticker on the meter
A QR code is just a link you cannot read. That is convenient, and it is exactly why scammers like them: you cannot tell where one leads until you have already scanned it. "Quishing" is phishing that hides behind a QR code.
Where fake QR codes turn up
A sticker placed over the real code on a parking meter, a restaurant table, or an EV charger, sending your payment to a scammer. A code in an email or letter that claims you must scan it to "re-verify" an account. A code on a flyer or a too-good deal.
Because the code jumps you from a work computer to your personal phone, it can also slip past the security tools that would have flagged a bad link on your laptop.
The simple checks
Before you open it, look. Most phone cameras show the web address the code points to first; if it is a look-alike or a shortener you cannot verify, do not open it. On a physical code, check for a sticker laid over another.
Be very wary of any QR code that asks you to log in or pay. For payments and sign-ins, go to the official app or type the address yourself rather than trusting a printed code.
At work
A common trick is an email saying you must scan a QR code to keep your account or re-enrol your authenticator. Treat that exactly like a phishing link: do not scan it, and check with IT through a known channel.
The short version
- A QR code is a link you cannot read until you have scanned it.
- Check the address your camera previews before opening, and check physical codes for stickers.
- Never log in or pay through a QR code you were sent or that was posted in public.
- A work email telling you to scan a code to keep access is phishing.
Build the reflex, not just the knowledge.
BadgerQuest is a two-minute daily game that keeps this instinct sharp. Free for individuals, no card.
Play a round free →Training a team instead? See pricing · QR and card-payment security training
Common questions
Can scanning a QR code hack my phone?
Scanning itself just reveals a link. The risk is what the link leads to: a fake login or payment page, or a prompt to install something. Preview the address before opening it, and never enter credentials or card details from a QR code you did not expect.
How do I check a QR code is safe?
Most phone cameras show the destination address before you open it; make sure it is the real, exact domain and not a look-alike or an unknown shortener. On a physical code, check that no sticker has been placed over the original.
Why are QR code scams becoming more common?
QR codes went mainstream for menus and payments, people are used to scanning them without thinking, and a code hides its destination and can move you onto a personal phone that has fewer protections. That combination is attractive to scammers.