Don't scan blind
Check suspicious QR codes before opening the link. QR Code Check helps you preview risk, spot suspicious URLs, and avoid phishing traps.
Learn more about the app at qrcodecheck.app
Quishing attacks hide malicious links inside QR codes. Fake parking meters, restaurant menus, delivery notices, and emails are tricking people into giving up credentials and payments every day.
Quishing — short for QR phishing — is a social engineering attack that hides malicious links inside QR codes. Because QR codes can't be read by the human eye, victims have no way of knowing where a code leads until they scan it.
Attackers place fake QR codes on parking meters, restaurant tables, delivery notices, and in emails. When scanned, these codes redirect to convincing phishing pages designed to steal credentials, payment details, or install malware on your device.
Unlike traditional phishing links in emails, QR codes bypass email security filters entirely. The link is embedded in an image, making it invisible to automated scanning tools. This is why quishing is one of the fastest-growing attack vectors in cybersecurity.
Fake QR codes can appear on parking meters, menus, delivery notices, and emails. These are the most common attack scenarios.
Criminals place fake QR code stickers over legitimate payment codes on city parking meters. When a driver scans the code to pay for parking, they're redirected to a convincing but fraudulent payment page that captures their credit card details. The victim believes they've paid for parking, but instead their payment information has been stolen.
Post-pandemic, QR code menus have become standard in restaurants and cafes. Attackers exploit this by replacing legitimate menu QR codes with tampered stickers that redirect diners to phishing sites. These pages may mimic the restaurant's ordering system, collecting payment information or prompting users to download a malicious "menu app."
Fake missed-delivery cards are left on doorsteps with a QR code to "reschedule your delivery." When scanned, the code leads to a phishing page that mimics a major courier (Australia Post, FedEx, DHL). Victims are asked to enter personal details and pay a small "redelivery fee" — but the page captures their full payment credentials.
Employees receive urgent emails containing QR codes — "Scan to access the shared document" or "Verify your credentials before account lockout." Because the malicious link is embedded in a QR code image rather than a clickable URL, it completely bypasses corporate email security filters. This makes quishing especially dangerous in enterprise environments.
Posters and signs in airports, hotels, and cafes offer "Free Wi-Fi" via a QR code. When scanned, the code connects the traveller to a rogue access point or redirects to a captive portal that harvests login credentials. Some variants install device profiles or VPN configurations that allow the attacker to intercept all traffic.
QR codes are commonly used for cryptocurrency wallet addresses and payment transfers. Attackers swap legitimate payment QR codes with their own wallet addresses, or create fake "payment required" QR codes in emails and invoices. Since crypto transactions are irreversible, victims have no way to recover stolen funds.
You can't see where a QR code leads until you scan it. These steps help you avoid quishing traps.
Look for signs of tampering — stickers placed over existing QR codes, uneven edges, or codes that look out of place. If a QR code appears damaged or modified, don't scan it.
After scanning, check the URL before tapping. Look for misspellings, unusual domains, or URLs that don't match what you expect. A parking meter shouldn't link to a random .xyz domain.
Legitimate services rarely ask for login credentials through a QR code. If a scanned code asks for your password, bank details, or personal information, close the page immediately.
If a QR code claims to be from a business, verify by going directly to their official website or contacting them. Don't trust QR codes on random flyers, unsolicited emails, or public posters.
If you find a suspicious QR code in public, report it to the venue or local authorities. Removing or covering a single tampered code can protect hundreds of people from falling victim.
QR Code Check analyses every QR code for threats before you open the link. Multi-source threat intelligence and on-device AI help you spot suspicious URLs, phishing pages, and malware — all without your data leaving your phone.
Download QR Code Check
Check suspicious QR codes before opening the link. QR Code Check helps you preview risk, spot suspicious URLs, and avoid phishing traps.
Learn more about the app at qrcodecheck.app