QR code safety: spot and avoid QR code scams

What "quishing" means

Quishing is phishing with a QR code instead of a clickable link. The code leads to a fake login page, a fake payment form, or a download you did not ask for. Because the link is an image, it can be harder for some email filters to check. And because you usually scan it with a phone, the address is shown in a small space that is easy to skim past.

The QR code itself cannot harm your device. The risk is the page, app, or network it sends you to, and what you do there.

Common QR code scams

Fake stickers on parking meters and EV chargers

A scammer prints a code and sticks it over the real one, or next to it with a "Scan to pay" message. It opens a convincing payment page that collects your card details. Look for a label stuck on top of another, peeling edges, or a code that does not match the operator's branding. When in doubt, use the operator's official app or the payment options built into the machine.

Restaurant tables, posters, and flyers

Table menus, event posters, and flyers in public places are easy to cover with a fake code. A menu code should open a menu. If it asks you to sign in with an email or social media account, or to enter card details before you have ordered anything, ask the staff.

Phishing emails, letters, and fake delivery notices

Messages claiming that your password is about to expire, a parcel is waiting, a fine is unpaid, or a refund is due often include a QR code and urgent wording. Some arrive as printed letters that look official. Real organizations rarely ask you to scan a code to sign in or to pay. Open the official website or app you already use and check there instead.

Payment redirection

A code on an invoice, a donation poster, or a payment request can quietly send money to someone else's account. Before you confirm any payment, check the recipient's name and the amount on the payment screen. If an invoice suddenly has new bank details, confirm them by phone or through a channel you already trust.

Malicious app downloads

Some codes lead to an app download from outside the official app store, or to a page that says you must install a "required" app, profile, or update. Install apps only from your device's official store, and be wary of any code that asks you to change security settings.

Wi-Fi codes for rogue networks

A Wi-Fi code can connect you to a network run by someone other than the venue. On that network, a fake sign-in page may ask for your email password or card details. Only join networks you expect to find in that place. TheWi-Fi QR code guide explains what these codes contain.

How to check a link before you open it

• Read the domain from right to left. Start at the end of the host name and move left. In example.com.pay-parking.net, the site you would visit ispay-parking.net; everything to its left was chosen by whoever owns that domain.
• Watch for look-alike domains. Swapped or extra letters (examp1e.com), added words (example-support.com), or a different ending, such as .co instead of .com, are common tricks.
• Be careful with xn--. Host names that start with or containxn-- are internationalized domain names written in punycode. They are normal for many languages, but they can also imitate a familiar name with characters from another alphabet. If you expected a plain brand name and see xn--, stop.
• Short links hide the destination. A URL shortener tells you nothing about where you will end up. Be especially careful when a code for a login or payment uses one.
• HTTPS is not proof of safety. The padlock means the connection is encrypted, not that the site is honest; scam sites use HTTPS too. A login or payment page without HTTPS, though, is a clear warning sign.
• Ask whether the request makes sense. A parking sign has no reason to ask for your email password, and a menu has no reason to ask for your bank login.

How this scanner helps

The QR Code Scanner is designed so you see what a code contains before anything happens:

• The full address comes first. Links show the host on its own line, plus the complete URL, so you can read the domain before you decide.
• Unencrypted links get a warning. If a link uses http:// instead of https://, the result says so.
• Nothing opens automatically. A link opens only when you selectOpen link, and then in a new tab. You can use Copy linkinstead and check it elsewhere.
• Unusual link types are never opened. Codes containingjavascript:, data:, intent:, app deep links, or any other unrecognized scheme are shown as plain text with a warning, and there is no button to open them.
• You can always see the raw content. Every result includes exactly what the code contains, with a Copy button.
• Your scans stay on your device. Decoding happens in your browser, and nothing you scan is uploaded.

What to do if you already entered your details

It happens to careful people too. Acting quickly limits the damage:

1. Close the page and do not enter anything else.
2. If you entered a password, change it right away on the real website or app, and anywhere else you use the same password. Turn on two-step verification if it is offered.
3. If you entered card or bank details or made a payment, contact your bank or card provider straight away, using the number on your card or their official app. They can block the card and help dispute the payment.
4. If the code installed an app or profile, remove it and make sure your device's system software is up to date.
5. Report it. Tell the venue or operator about a fake sticker so they can remove it, report phishing emails to your email provider, and report fraud to your local police or national fraud reporting service.
6. Watch your accounts and statements for unusual activity over the following weeks.