Quick answer: “quishing” is phishing through QR codes: scammers stick fake codes on parking meters, restaurant tables, posters or send them by email to steal passwords and card details. Always check the web address after scanning, never enter logins or payment data on a page you reached from an unknown QR code, and pay only through official apps.
QR codes are safe by themselves — they only contain text or a link. The danger is where the link takes you. Because you can’t read a QR code with your eyes, scammers use them to hide malicious links. Here’s how the scams work and how to protect yourself and your customers.
Common QR code scams
- Fake parking payment codes: stickers placed over real codes on parking meters send you to a fake payment page.
- Email “security” QR codes: messages pretending to be Microsoft, your bank or HR ask you to scan a code to “re-activate” your account.
- Fake delivery notices: a note or text with a QR code for a “missed parcel” fee.
- Swapped restaurant or shop codes: a sticker over the real menu or payment code.
- Crypto “giveaways”: codes promising to double your crypto.
- Malicious app downloads: codes that open fake app pages outside the official stores.
7 rules to scan QR codes safely
- Read the address before opening. Your camera shows the domain — look for misspellings like
paypa1.comor strange endings. - Never log in or pay on a page opened from a QR code you don’t trust. Open the official app or type the address yourself.
- Check for stickers. On parking meters, posters and tables, feel whether the code is a sticker placed over another one.
- Be suspicious of urgency — “your account will be closed”, “pay within 1 hour”.
- Don’t scan QR codes in unexpected emails, especially ones asking you to sign in.
- Install apps only from the App Store or Google Play.
- Use a scanner that shows the content first. The PAYATE QR Code Scanner shows the full text and link before you open anything.
How to check a QR code before opening it
Take a photo or screenshot of the code and upload it to the online QR scanner. You will see exactly what’s inside — the full link, Wi-Fi details or text — without visiting the site.
For businesses: protect your customers
- Print codes directly on the material instead of using stickers, or use tamper-evident labels.
- Check your public QR codes regularly for stickers placed on top.
- Point codes to your own domain so customers recognise it.
- Add a short caption with your domain under the code, e.g. “Opens payate.com/menu”.
What to do if you entered data on a fake page
- Change the password immediately and enable two-factor authentication.
- Call your bank to block the card if you entered payment details.
- Report the fake code to the business, parking operator or police.
Check any code safely: free QR code scanner →