QR codes are everywhere now — on parking meters, restaurant tables, package slips, and flyers. Point your phone’s camera, tap the link, and you’re done. That convenience is exactly what criminals are counting on. In a scam known as quishing (QR phishing), fraudsters replace or fake QR codes so that one innocent scan sends you to a booby-trapped website, a payment page they control, or a download that infects your phone.
This is not a theoretical threat. The FBI reports that in 2025, scams in which criminals directed victims to crypto ATMs — often by having them scan QR codes — produced 13,460 complaints and $389 million in losses, a 58% jump in losses from the year before. In Malaysia, police recorded 5,134 QR code scam cases and RM28.67 million in losses in just the first half of 2026, with annual case counts climbing from 223 in 2023 to 5,907 in 2025. And the U.S. Federal Trade Commission has warned consumers directly about scammers pasting their own QR stickers over legitimate ones on parking meters.
The good news: a QR code can’t hurt you until you act on what it shows you. Once you learn to pause, preview, and verify, quishing loses almost all of its power. Here’s how these scams work and how to scan safely.
What Is Quishing?
Quishing is phishing delivered through a QR code. A QR code is just a visual shortcut to a link, a payment address, or an action on your phone — it carries no built-in proof of where it came from. Criminals exploit that blind trust in two main ways: they physically replace legitimate codes (a sticker over a parking meter’s real code, a doctored restaurant menu), or they distribute fake codes through emails, text messages, flyers, and even packages you never ordered.
When you scan a malicious code, several things can happen: you land on a lookalike website designed to harvest your login credentials or card details; you’re pushed toward a payment to the scammer’s account; or the scan triggers a download that installs malware. In every version, the scam relies on you acting quickly without checking where the code actually leads.
How QR Code Scams Work: The Common Setups
1. The parking meter sticker swap
The FTC has specifically warned about this one: scammers place their own QR stickers over the legitimate payment codes on parking meters. You scan, thinking you’re paying the city, but you land on a fake payment page that collects your card number — and your “parking fee” goes straight to a criminal.
2. Fake package and delivery slips
A card left at your door or a text claims a package needs redelivery or a customs fee, with a QR code to “track” or “pay.” The code opens a convincing copy of a postal or courier website that asks for personal details and a small payment — enough to steal your card and identity.
3. Crypto ATM direction
In some of the costliest cases, scammers impersonating officials or “fraud departments” instruct victims to go to a crypto ATM and scan a QR code displayed on the machine or sent by the scammer. The code is the criminal’s wallet address. Once the crypto is sent, it is effectively gone — which is why the FBI’s 2025 figures for this category are so severe.
4. Restaurant, charity, and event fakes
Fake menus, donation appeals, or event posters carry codes that lead to credential-harvesting pages or payment forms. Because the setting feels casual and trustworthy, people scan without a second thought.
5. QR codes in phishing emails and texts
Some phishing messages now skip clickable links entirely and embed a QR code instead — partly to dodge email security filters that scan links. The message invents an urgent account problem and tells you to scan to “verify” or “secure” your account.
Red Flags: QR Code Scam Checklist
Run through this list before you scan anything:
- The code looks tampered with — a sticker over another code, uneven edges, or signage that looks altered.
- It arrived unexpectedly — an unsolicited email, text, or package pushing you to scan.
- It creates urgency — unpaid fees, account suspension, a prize expiring, a delivery at risk.
- The previewed link looks wrong — misspellings, swapped letters, odd domains, or URL shorteners hiding the real destination.
- It asks for login or payment details — especially after a scan you didn’t plan.
- Scanning triggers a download — a QR code should never force an app install or configuration profile.
- It’s in a public place you can’t verify — anyone can stick a code on a wall; placement proves nothing.
Any single red flag is reason enough to stop.
How to Scan QR Codes Safely
Make these habits automatic:
- Preview before you open. Most phone cameras show the link destination before opening it. Read it carefully — check for misspellings, strange domains, and shortened URLs.
- Inspect the physical code. On meters, menus, and posters, look for stickers layered over the original, or codes that don’t match the surrounding branding.
- Use your phone’s built-in camera. Avoid third-party QR scanner apps, which are sometimes poorly secured or bundled with unwanted software.
- Type it yourself when it matters. For payments or account matters, open the company’s official app or type its real web address manually instead of following a scanned link.
- Keep your phone updated. Current operating systems and browsers are better at blocking malicious pages and warning you about dangerous sites.
- Never enter sensitive data after a scan. No legitimate company needs you to log in or pay via a QR code you found in the wild.
- Say no to unexpected downloads. If scanning starts a file download or asks to install something, cancel immediately.
What to Do If You Scanned a Bad QR Code
Act quickly but methodically:
- Only scanned, didn’t enter anything? Your risk is low. Close the page and don’t interact with it further.
- Entered a username or password? Change it right away on a trusted device — and change it anywhere else you reused it. Turn on two-factor authentication.
- Entered card or bank details? Call your bank or card issuer immediately using the number on your card. Ask about freezing the card and disputing charges.
- Sent crypto to a scanned wallet address? Contact your exchange immediately and report to the FBI’s IC3 — recovery is very difficult, so speed is everything.
- Downloaded something? Disconnect from the internet, run a reputable security scan, and consider having the device checked professionally.
- Review your statements. Check bank and card transactions for anything you didn’t authorize.
How to Report a QR Code Scam
- Report to the FTC at ReportFraud.ftc.gov.
- Report to the FBI’s IC3 at ic3.gov, especially if money was lost.
- Tell the business or property owner if a fake sticker was placed on their meter, menu, or signage so they can remove it.
- Report phishing emails and texts through your email provider’s phishing report option or by forwarding texts to 7726 (SPAM).
The Bottom Line on QR Code Scams
A QR code scam works because scanning feels harmless and instant — but a code is only as trustworthy as whoever placed it. The defense is simple: preview the destination, inspect the physical code, and never log in or pay through a link you reached by scanning something unexpected. Make that pause your reflex, and quishing can’t touch you.
Sources
- Federal Trade Commission, “See a QR code parked somewhere? Don’t scan it…yet!” (Consumer Alert, September 2026) — https://consumer.ftc.gov/consumer-alerts/2026/09/see-qr-code-parked-somewhere-dont-scan-ityet
- Bitcoin Magazine, “American Crypto Fraud Topped $11 Billion In 2025, Shattering Records: FBI” (2026) — https://bitcoinmagazine.com/news/american-crypto-fraud-topped-11-billion
- Asia Pacific Telegraph, “Police Data Shows QR Code Scam Losses Nearly Doubling Year Over Year” (2026) — https://asiapacifictelegraph.com/malaysia-records-rm28-67-million-in-qr-code-scam-losses-for-first-half-of-2026/
- CCN, “$11.4 Billion Lost: Crypto Scams Explode 22% in 2025, FBI Warns” (2026) — https://www.ccn.com/news/crypto/11-4-billion-lost-crypto-scams-explode-22-in-2025-fbi-warns/
- SmartHouse, “FTC Warns About Increased QR Code Scams” — https://www.smarthouse.com.au/ftc-warns-about-increased-qr-code-scams/
Last reviewed: October 2026
This article is for education only and is not financial or legal advice.