QR code phishing (quishing): what it is and how to spot it
QR code phishing, often called quishing, uses a QR code to send you to a fake website that steals passwords, card details or money. The code hides the link, so you cannot see the destination until you scan. Check the full address before you open it, and never pay or sign in from an unexpected code.
What quishing is
A normal phishing email shows a link you can hover over and inspect. A QR code shows only black and white squares. Scammers use that to hide a fake login or payment page behind something that looks official, printed on a sticker or placed in an email.
Scanning a code is not dangerous by itself. The risk comes after, when the page asks you to sign in, pay, enter card details or install something. Quishing works because people treat scanning as a quick, trusted step and skip the checks they would make with a link.
Common QR code scams
- Fake parking meter stickers: a new code stuck over the real one on a parking machine or sign, leading to a copy of a parking payment site that takes your card details.
- Look-alike domains: pages on addresses that resemble a real brand, with a swapped letter, an extra word such as secure or login, or the brand name placed in a subdomain of an unrelated site.
- Fake delivery notices: a card or message saying a parcel could not be delivered, with a code to reschedule and pay a small fee.
- Fake payment or account notices: a letter or email claiming a bill is overdue, a tax refund is waiting or an account is locked, with a code to fix it.
- Codes in emails to dodge filters: email security tools scan text links but often cannot read a link inside an image. A QR code in an email, especially one asking you to set up two-factor sign-in or read a shared document, is a strong warning sign.
- App download codes: a code that installs an app from outside the official app store, or a fake version of a real app.
- Hidden destinations: link shorteners or chains of redirects that stop you seeing the final page until it has loaded.
How to check a QR code before you open it
- Look at the code itself. On a meter, poster or menu, check whether it is a sticker placed over something else, or looks newer than the sign around it.
- Scan it with a tool that shows the full link before opening. On iPhone, read the domain in the Camera banner before you tap.
- Read the domain from right to left, starting at the part just before the first single slash. In citycouncil.pay-parking-now.com, the site you are really visiting is pay-parking-now.com, not the council.
- Be wary of link shorteners, bare numbers such as 203.0.113.4 instead of a name, and http rather than https.
- If the code leads to a payment or sign-in page, stop. Type the company's address yourself or open its official app instead.
- Do not install apps from a QR code unless it opens the official App Store or Google Play listing of a company you already trust.
How NeoReader's scanner helps
NeoReader's QR scanner shows you the full content of a code before anything opens, and runs a set of checks on scanned links. It flags look-alike brand domains, destinations hidden behind link shorteners, bare IP addresses and links that start an app download. The checks run in your browser, and camera frames and images are read on your device and never stored.
No automatic check catches every scam, so treat a warning as a reason to stop, and a clean result as a reason to still read the address. The NeoReader QR browser extension for Chrome, Edge and Firefox runs the same link safety check when you scan codes on web pages and in emails.
Warning signs in the page itself
- It asks for a password or a one-time code straight after you scan.
- It rushes you: a fine increases, an account closes or a parcel is returned unless you act now.
- It asks for full card details for a small fee.
- The design is close to a real brand but spelling, logos or prices look slightly off.
- It asks you to download a file or app to view a document, a menu or a parking tariff.
If you think you scanned a scam code
- Close the page. Do not enter anything else.
- If you entered a password, change it now on the real site, and anywhere else you use it. Turn on two-factor sign-in.
- If you entered card or bank details, call your bank using the number on your card and ask them to block it.
- If you installed an app, delete it and check your phone's settings for any new profiles or device admin permissions.
- Report it: tell the company being copied, the car park or venue operator if it was a sticker, your employer's IT team if it came by work email, and your national fraud reporting service.
Tips for businesses using QR codes
If you print QR codes, make them easy to trust. Put your domain in plain text next to the code so people can compare it with the link they see. Use tamper-evident placement where you can, and check public codes regularly for stickers. Static codes that link straight to your own domain are easier to verify than codes that go through a third-party redirect.
