Quishing is phishing delivered through a QR code instead of a normal clickable link. Action Fraud received 784 quishing reports between April 2024 and April 2025, with almost £3.5 million lost. With QR code scams on the rise, knowing the warning signs can help you avoid fake payment pages.
Key Takeaways
- Quishing hides a phishing link inside a QR code.
- Fake codes often appear in car parks, emails, invoices, and delivery messages.
- Scanning alone rarely causes harm unless you enter details or approve a download.
- Always preview the destination and check the web address before continuing.
- Avoid QR code stickers placed over original signs or payment instructions.
- Contact your bank quickly if you entered payment details or sent money.
Nic Roe, a solicitor at WRS, has provided the following comment:
“Quishing is effective because it exploits a moment of trust. People are used to scanning QR codes for parking, deliveries, and account access, so a fake code in a familiar setting rarely triggers suspicion. By the time the victim realises the page is fraudulent, payment details or credentials have already been handed over. If you have scanned a suspicious code and shared financial information, the most important step is to contact your bank immediately and preserve every piece of evidence – the QR code itself, the web address it opened, and any transaction records. Early action can make a significant difference to the recovery options available.”
What Is Quishing
What is quishing? Quishing is a phishing scam that uses a QR code to send you to a fraudulent website. The attacker replaces the usual clickable link with an image you scan using your phone.
QR code phishing works because you cannot read the destination directly from the code itself. The website may copy a bank, parking provider, courier, or workplace login page. Quishing scams then collect passwords, card details, security codes, or other personal information.
How Quishing Attacks Work
A quishing attack usually follows a simple chain. You scan a code, your phone opens a website, and the page asks for information or payment. The page may look genuine enough to stop you questioning the request.
| Step | What happens | Main risk |
|---|---|---|
| Scan | You scan a QR code | You are redirected |
| Redirect | A fake website opens | The page copies a trusted brand |
| Submit | You enter details or pay | Credentials or money are stolen |
A common QR code phishing example is a parking sticker that opens a fake payment page. QR code phishing attacks can also begin inside emails or invoices. The final page often looks similar to the real service.
Where Fake QR Codes Appear
Fake codes work best where scanning already feels normal. Criminals use places where you expect quick payments or account checks. The following settings are common places to encounter QR code scams.
Parking Meters and Signage
QR code parking scams often involve stickers placed over genuine signs or payment instructions. The fake code opens a cloned parking page and asks for card details. UK councils have warned about fraudulent QR stickers appearing on parking machines.
A QR code sticker scam can be difficult to notice when the label matches the surrounding design. Check whether a sticker looks newly added or covers another code. Use the official parking app or type the provider’s address yourself.
Emails and Fake Invoices
QR code phishing emails may imitate IT teams, banks, suppliers, or delivery companies. The message asks you to scan a code to verify an account or view a document. Your phone then opens a spoofed login page.
The usual checks still apply when learning how to spot scam emails. Check the sender, urgency, wording, and reason for the request. Contact the organisation independently when the message asks for passwords or payments.
Parcels and Delivery Notes
Scammers may place QR codes on unexpected parcels, delivery cards, or printed notices. The code may claim you owe a redelivery fee or need to confirm your address. The resulting page can collect payment and identity information.
Treat unexpected delivery requests with caution, even when the parcel appears genuine. Open the courier’s official app or website independently. Do not rely on the address hidden inside the QR code.
Why Quishing Bypasses Security Filters
QR codes can help attackers hide malicious links inside an image. Some security tools may not inspect the destination embedded in that image. Users also often scan codes using personal phones with fewer workplace protections.
This helps explain why QR code phishing can succeed where obvious email links fail. A phone screen may also show less of the full web address. The scam then relies on you trusting the page after scanning.
What Happens If You Scan
Scanning a QR code alone usually does not cause immediate harm. The main risk begins when you enter information, approve a payment, download software, or grant permissions. Close the page if the destination looks unexpected.
The scam still depends heavily on human trust and urgency. These are common social engineering scam tactics used across phishing, impersonation, and payment fraud. Do not continue simply because the code appeared in a familiar place.
How to Protect Yourself
Small checks can stop many QR code scams before they reach your accounts. Slow down whenever a code asks for money, credentials, or personal details. Treat physical stickers and unexpected email codes with extra caution.
You should:
- Preview the web address before opening it.
- Check for spelling changes or unusual domains.
- Avoid stickers placed over original printed codes.
- Type important website addresses manually.
- Use official apps for parking and banking.
- Enable two-factor authentication on important accounts.
- Keep your phone and browser updated.
- Never enter security codes after an unexpected request.
Where a fake page exposes credentials, phishing scam recovery services may help assess any resulting financial loss. Prevention is easier when you verify the organisation through a separate channel. Never use contact details shown only on the suspicious page.
Lost Money to a QR Scam
Act quickly if you entered card details, shared credentials, or made a payment. Contact your bank and explain exactly how the QR code led to the transaction. Ask it to secure your account and consider any available refund route.
Take these steps:
- Contact your bank or card provider immediately.
- Change exposed passwords from a safe device.
- Enable two-factor authentication where available.
- Save the QR code, website address, messages, and payment records.
- Report the suspicious website to the NCSC.
- Report financial loss to Report Fraud, previously known as Action Fraud.
- Contact Police Scotland if you live in Scotland.
The NCSC accepts reports of suspicious websites, while financial losses should be reported through Report Fraud in England, Wales, and Northern Ireland. People in Scotland should report fraud to Police Scotland.
Eligible Faster Payments and CHAPS APP scam claims can receive reimbursement up to £85,000 under the mandatory rules. If reimbursement is refused, bank fraud recovery solicitors can assess the decision and other recovery routes. Speed and evidence can affect the options available.
Wealth Recovery Solicitors is an SRA-regulated firm handling bank fraud, phishing, investment scams, and digital asset tracing. Its legal and forensic team can review the payment trail and available recovery routes. No win, no fee options may be available in suitable cases.
If you believe you have been a victim of a scam, contact us at Wealth Recovery Solicitors for a free consultation with our experienced team to determine the most effective route to recovering your funds.
FAQs
Can scanning a QR code install malware?
Scanning alone does not usually install malware on a modern phone. The risk increases if you download a file, install an app, or approve unexpected permissions. Close suspicious pages and remove anything you installed after scanning.
Will my bank refund a quishing payment?
A refund may be available depending on how you paid and what happened. Eligible APP scam transfers through Faster Payments or CHAPS may fall under mandatory reimbursement rules. Card payments may use different refund or chargeback processes.
How do I report a fake QR code?
Tell the business, council, or venue where you found the suspicious code. You can report the linked website to the NCSC if you believe it is fraudulent. Report financial loss to Report Fraud, or Police Scotland if you live in Scotland.
Are iPhones safer than Android for QR codes?
Both iPhones and Android phones can open malicious websites through QR codes. Built-in protections may reduce some risks but cannot stop you entering information on a convincing fake page. Safe checking habits matter on both platforms.
What should I do straight after scanning?
Close the page if you have not entered information or downloaded anything. Change passwords and contact your bank if you submitted sensitive or payment details. Preserve the QR code and website address if you may need to report the incident.