QR codes are everywhere—on restaurant tables, parking meters, posters, and payment terminals—and scammers have noticed. “Quishing” (QR code phishing) uses a fake or tampered code to send you to a malicious website that steals your passwords and card details, or tries to install malware. The good news: a QR code is just a link in disguise, so a few simple habits keep you safe. Here's how QR code scams work, the red flags to watch for, and exactly what to do if you scan a bad one—based on current FBI and FTC guidance.
Quishing is phishing that hides its bait inside a QR code instead of a clickable link. A normal phishing email shows a web address you can inspect before clicking. A QR code hides that address completely until your camera opens it—which is exactly why scammers like it. The code itself is harmless; the danger is where it points and what the page asks you to do next.
Because the destination is invisible until you scan, QR codes can also slip past email security filters that would normally flag a suspicious link. That has made quishing a fast-growing tactic in both inboxes and the physical world, according to the FBI's Internet Crime Complaint Center (IC3).
Yes—scanning a QR code, by itself, cannot install anything on your phone or hack your device. A QR code is just encoded text, almost always a web address. The risk starts after you scan: if the code opens a fake login page and you type your password, prompts you to download an “app” that is really malware, or sends you to a payment page controlled by a scammer. Treat a scanned QR code exactly like a link a stranger handed you.
Most QR scams fall into a handful of patterns. Once you know them, the fakes are easy to spot.
The classic version—flagged by the FBI back in 2022—is a sticker. Scammers print a malicious QR code on a sticker and place it over a legitimate one: on a parking meter, an EV charger, a bike-share dock, or a table tent. You think you're paying for parking; you're actually entering your card details on a scam site. The FBI documented criminals tampering with QR codes to steal victim funds this way.
In 2025, the FBI and FTC both warned about a newer twist: an unsolicited package you didn't order arrives with a QR code and a note telling you to scan it to find out who sent it or to arrange a return. Scanning leads to a page that harvests personal and financial information—or asks you to install data-stealing software. It's a spin on the “brushing” scam, now weaponized with QR codes, per the FBI's 2025 IC3 alert and the FTC's consumer warning.
The same trick lands in your inbox: an email claiming your account is locked, a package needs “redelivery,” or a document is waiting—with a QR code to scan “to verify.” Scanning opens a convincing fake login page. Because the malicious link is buried inside an image, these messages often sail past spam filters that would catch an ordinary text link.
Scammers also post codes promising a refund, a prize, a discount, or a charitable donation, then route you to a payment or credential-harvesting page. If a code pressures you to act fast or pay immediately, that urgency is the scam.
The FTC's advice comes down to a few simple habits:
If your business uses QR codes on signage, packaging, or flyers, you're a target too—a scammer who covers your code with theirs harms your customers and your brand. A few practices lower the risk:
No tool can stop someone from printing a malicious sticker out in the world, but controlling and monitoring your own codes—and designing them to be hard to imitate—makes tampering far easier to catch. If one of your codes stops working or behaves oddly, our guide on why a QR code isn't working can help you diagnose it.
Not on its own. A QR code can't install malware just by being scanned—it only contains data, usually a link. Infection requires a further step: visiting a malicious site and then downloading and installing a file. Don't install anything a scanned code prompts you to.
Scanning alone won't hack your phone. The attacker's goal is to trick you into an action afterward—entering credentials, approving a login, or installing an app. Keeping your operating system updated and using multi-factor authentication closes most of these paths.
Preview the URL before opening it, make sure it matches the business and isn't a look-alike domain, check the physical code for sticker tampering, and never scan codes that arrive unexpectedly. When in doubt, type the address yourself instead of scanning.
Yes. A QR code you generate simply encodes the destination you choose—it adds no risk of its own. The safety question is always about where a code points and whether it's been tampered with after printing. Design your codes to be recognizably yours, and use a dynamic QR code if you want the option to update or disable the destination later.
QR codes are convenient and, used carefully, perfectly safe. Quishing works by hiding a malicious link where you can't inspect it and adding a dose of urgency. Preview every URL, ignore codes you didn't expect, and never enter a password or payment on a page you reached by scanning an unfamiliar code—and you'll sidestep virtually every QR scam out there.
QR codes are everywhere—on restaurant tables, parking meters, posters, and payment terminals—and scammers have noticed. “Quishing” (QR code phishing) uses a fake or tampered code to send you to a malicious website that steals your passwords and card details, or tries to install malware. The good news: a QR code is just a link in disguise, so a few simple habits keep you safe. Here's how QR code scams work, the red flags to watch for, and exactly what to do if you scan a bad one—based on current FBI and FTC guidance.
Quishing is phishing that hides its bait inside a QR code instead of a clickable link. A normal phishing email shows a web address you can inspect before clicking. A QR code hides that address completely until your camera opens it—which is exactly why scammers like it. The code itself is harmless; the danger is where it points and what the page asks you to do next.
Because the destination is invisible until you scan, QR codes can also slip past email security filters that would normally flag a suspicious link. That has made quishing a fast-growing tactic in both inboxes and the physical world, according to the FBI's Internet Crime Complaint Center (IC3).
Yes—scanning a QR code, by itself, cannot install anything on your phone or hack your device. A QR code is just encoded text, almost always a web address. The risk starts after you scan: if the code opens a fake login page and you type your password, prompts you to download an “app” that is really malware, or sends you to a payment page controlled by a scammer. Treat a scanned QR code exactly like a link a stranger handed you.
Most QR scams fall into a handful of patterns. Once you know them, the fakes are easy to spot.
The classic version—flagged by the FBI back in 2022—is a sticker. Scammers print a malicious QR code on a sticker and place it over a legitimate one: on a parking meter, an EV charger, a bike-share dock, or a table tent. You think you're paying for parking; you're actually entering your card details on a scam site. The FBI documented criminals tampering with QR codes to steal victim funds this way.
In 2025, the FBI and FTC both warned about a newer twist: an unsolicited package you didn't order arrives with a QR code and a note telling you to scan it to find out who sent it or to arrange a return. Scanning leads to a page that harvests personal and financial information—or asks you to install data-stealing software. It's a spin on the “brushing” scam, now weaponized with QR codes, per the FBI's 2025 IC3 alert and the FTC's consumer warning.
The same trick lands in your inbox: an email claiming your account is locked, a package needs “redelivery,” or a document is waiting—with a QR code to scan “to verify.” Scanning opens a convincing fake login page. Because the malicious link is buried inside an image, these messages often sail past spam filters that would catch an ordinary text link.
Scammers also post codes promising a refund, a prize, a discount, or a charitable donation, then route you to a payment or credential-harvesting page. If a code pressures you to act fast or pay immediately, that urgency is the scam.
The FTC's advice comes down to a few simple habits:
If your business uses QR codes on signage, packaging, or flyers, you're a target too—a scammer who covers your code with theirs harms your customers and your brand. A few practices lower the risk:
No tool can stop someone from printing a malicious sticker out in the world, but controlling and monitoring your own codes—and designing them to be hard to imitate—makes tampering far easier to catch. If one of your codes stops working or behaves oddly, our guide on why a QR code isn't working can help you diagnose it.
Not on its own. A QR code can't install malware just by being scanned—it only contains data, usually a link. Infection requires a further step: visiting a malicious site and then downloading and installing a file. Don't install anything a scanned code prompts you to.
Scanning alone won't hack your phone. The attacker's goal is to trick you into an action afterward—entering credentials, approving a login, or installing an app. Keeping your operating system updated and using multi-factor authentication closes most of these paths.
Preview the URL before opening it, make sure it matches the business and isn't a look-alike domain, check the physical code for sticker tampering, and never scan codes that arrive unexpectedly. When in doubt, type the address yourself instead of scanning.
Yes. A QR code you generate simply encodes the destination you choose—it adds no risk of its own. The safety question is always about where a code points and whether it's been tampered with after printing. Design your codes to be recognizably yours, and use a dynamic QR code if you want the option to update or disable the destination later.
QR codes are convenient and, used carefully, perfectly safe. Quishing works by hiding a malicious link where you can't inspect it and adding a dose of urgency. Preview every URL, ignore codes you didn't expect, and never enter a password or payment on a page you reached by scanning an unfamiliar code—and you'll sidestep virtually every QR scam out there.
