A QR code is a very good hiding place. It carries a link, but you cannot read the link with your eyes, so you have to trust whoever printed it. Every QR scam is a way of abusing that trust. The good news is that the defence is simple and does not need any software: read the address your phone shows you, and think for one second before you tap.
What a QR code can and cannot do
A QR code holds text, usually a web address. When your phone reads it, the phone decides what to offer: open a link, join a Wi-Fi network, save a contact, start a call. The code itself runs nothing. There is no known way for the squares alone to install software or take over a phone. The myths article covers that claim in detail.
The attack surface is what happens after the scan. That is where all four common scams live.
Quishing
Quishing is phishing with a QR code in place of a link. An email or a PDF invoice carries a code that leads to a fake login page, a fake payment page or a malware download. The code is an image, so an email filter that would have flagged the link sees nothing. And the victim scans with a personal phone, which is usually outside the company’s security tools.
The numbers are large but come from security vendors, so treat them as indicative. Microsoft’s threat intelligence, cited by Keepnet Labs, counted QR-based phishing attempts rising from 7.6 million in January 2026 to 18.7 million in March 2026, with about 70% delivered as PDF attachments. The same page puts QR codes in about 12% of all phishing attacks in 2025. Our statistics article explains how to read figures like these.
Official warnings have followed. The FBI’s Internet Crime Complaint Center published a public service announcement on 31 July 2025 about unsolicited parcels containing a QR code that invited the recipient to scan to find out who sent the gift. The FTC issued alerts about the same parcel scam on 23 January 2025, about fake traffic-ticket texts in April 2026 and about “brushing” parcels on 20 August 2026. Our round-up of the advisories has the details of each.
The sticker on the parking meter
The cheapest attack needs no technology beyond a label printer. A criminal prints a code that leads to a fake payment page and sticks it over the genuine code on a parking meter, a charging point or a restaurant table. Victims pay the criminal and get a parking fine as well.
This is not hypothetical. Orlando recovered about 200 fake stickers from downtown meters in June 2025 (ClickOrlando). New York’s Department of Transportation warned drivers in all five boroughs the same month (NY1). Redondo Beach in California found fake codes on about 150 meters (ABC7).
Tampered
Genuine
Do this
Open the parking operator's own app and type the meter number.
Not this
Scan the code on the meter and enter your card details on whatever page opens.
Rogue Wi-Fi codes
A Wi-Fi QR code carries a payload like WIFI:T:WPA;S:CafeGuest;P:secret;;. Scan it and your phone offers to join that network. The convenience is real. The risk is that a code stuck up in a public place can join you to a network the attacker runs, where unencrypted traffic can be watched and a fake login page can be shown when you open a browser. Modern phones and HTTPS limit the damage, but a network you did not choose is still a network you should not be on. Join Wi-Fi only from codes the venue gives you directly, and check the network name the phone shows before you accept.
QRLjacking
Some services let you log in on a computer by scanning a code with the phone that is already logged in. WhatsApp Web is the best known. QRLjacking attacks that flow. The attacker opens a real login page, copies its live QR code onto a phishing page, and gets the victim to scan it. The victim’s phone approves the attacker’s session, and the attacker is logged in as the victim. The OWASP description lists the steps and the fixes: session confirmation prompts, location checks, and not offering QR login where it is not needed. As a user, only scan a login code on a page you typed the address of yourself.
What your phone already does for you
On an iPhone, pointing the camera at a code shows a banner with the link, and nothing opens until you tap it (Apple support). Control Centre also has a Code Scanner button, and iPhone 16 models can start it from the Camera Control. Android’s camera and Google Lens behave the same way. That banner is the whole safety system. Read it.
Three things to check in the banner:
- The domain, not the start of the address.
parkmobile.io.pay-now.exampleis not ParkMobile. - Whether it is a shortened link. A short link on a printed public code hides the real destination, which is exactly what an attacker wants.
- Whether it matches the branding around the code. A council meter that leads to a personal domain is wrong.
What a trustworthy scanner collects
A scanner app needs the camera and nothing else. It should show you the decoded text in full, let you choose whether to open it, and keep any history on the device. It does not need your location, your contacts or an account. Some free scanner apps are advertising businesses that upload every scan; the QR code in a doctor’s waiting room says something about you.
Try it in QR Studio
QR Studio’s scanner shows the full decoded text before doing anything and keeps no server-side record of scans. The free decoder tool does the same for a code in a photo, entirely in your browser.
Safe scanning in five steps
- Look at the code. Is it a sticker over another sticker? Does it match its surroundings?
- Scan, but do not tap yet. Read the domain in the banner.
- Prefer the app. For parking, banking, deliveries and fines, open the official app or type the address.
- Never enter a password after a scan. If a code leads to a login page, close it and go to the site directly.
- Treat urgency as a warning. Fines, prizes, parcels and account lockouts are the standard bait.
▸Why a static code is harder to abuse than a dynamic one
A static code contains the final address, so what you see in the banner is where you are going. A dynamic code contains a short redirect link, so the banner shows the redirect service, not the destination, and the destination can change after printing. That is useful for a campaign and awkward for a reader who wants to check. If you print codes for the public, use your own domain for the redirect so the banner still shows a name people recognise. The static versus dynamic article covers the trade-off.
Try it yourself
Photograph a code you are unsure about and paste the picture into the decoder. It shows the raw text without opening anything, so you can read the whole address before you decide.