PlayInfoBox

Home /Education /How to Spot a Malicious QR Code (QR Phishing / "Quishing")

How to Spot a Malicious QR Code (QR Phishing / "Quishing")

Tap each term to learn how to use QR codes safely.

What "quishing" (QR + phishing) is

Quishing is a scam that uses a QR code that looks legitimate but is actually engineered to send you to a fake website or a malicious app-installation page instead of the real destination.

Check the destination link before you tap through

Most QR scanning apps show you the destination address before opening it. If it's an unfamiliar domain, or spelled slightly differently from an organization you recognize, it's safer not to proceed.

Watch for a sticker placed over a legitimate QR code

There have been reported cases of a fake QR code sticker placed directly over a legitimate one on parking payment machines or restaurant table codes, so checking whether a code looks peeled, doubled up, or oddly placed is a good habit.

Double-check the amount and recipient on payment QR codes

For any QR code that leads to a payment or money transfer, confirm the recipient information and amount shown on screen actually match what you intended before completing the transaction.

Be cautious if it pushes an app install outside the official app store

If scanning a code prompts you to download and install a file directly from some other site rather than through Google Play or the App Store, that's a strong sign of a malicious app, and it's best not to install it.

Use a QR scanner app with link preview

Some QR scanner apps and modern phone camera features show you the destination URL and flag risky sites before you connect, adding an extra layer of screening if you use one.

A phishing tactic that works even offline

What makes quishing distinctive is that it doesn't rely on a text message or email. It shows up on posters, table stickers, and flyers in the physical world. Because a QR code can't be checked for authenticity just by looking at it, the habit of checking the destination link after scanning becomes even more important.

Similar tricks to text-message phishing, different delivery

Like SMS phishing scams that use a text link, quishing often relies on manufactured urgency or impersonating a familiar service. The key difference is simply that the code is placed somewhere in the physical world rather than sent to your phone.

Frequently Asked Questions

Is it dangerous just to scan a QR code?

Simply scanning a code with your camera to preview the address is generally safe. The risk comes from actually visiting that address, installing an app, or entering information as instructed.

I already visited a suspicious QR code link and entered information, what should I do?

Change the password for any account you entered immediately, and if you entered payment details, contact your card issuer or bank to review recent transactions. If you installed a malicious app, uninstall it and run a security scan.