QR codes are everywhere — on parking meters, restaurant tables, posters, and packages — which is exactly why scammers have started hiding malicious links behind them. This is called "quishing" (QR phishing), and knowing a few warning signs is enough to stay safe.
What Is Quishing?
Quishing is a phishing attack that uses a QR code instead of a link in an email or text message. Since a QR code hides its destination until you scan it, it's an easy way for scammers to trick people into visiting a fake login page, downloading malware, or sending a payment to the wrong account.
Warning Signs of a Malicious QR Code
- A sticker placed on top of another QR code, on a parking meter, poster or menu — check that the QR isn't printed on a suspicious sticker covering the original.
- A QR code that arrived out of nowhere, in an email, text message or a note left on your windshield, especially one demanding urgent action ("pay now or lose your spot").
- Pressure and urgency: fines, missed deliveries, or limited-time offers are classic tricks to stop you from thinking twice.
- A shortened or unfamiliar link once you preview it, instead of a recognizable company domain.
How to Check Where a QR Code Leads Before Opening It
Most phone cameras show a preview of the link before opening it — read the full domain carefully before tapping. If it doesn't match who you'd expect (your bank, the parking company, the restaurant), don't continue.
You can also use a dedicated QR code reader, like LibreQR's free online scanner, to decode a QR code and see the exact destination link first, without opening it in your browser.
Practical Safety Tips
- Never enter passwords, card details or personal information on a page you reached by scanning an unexpected QR code.
- Check for tampering: does the QR code look like a sticker placed over something else?
- When in doubt, go directly to the official app or website instead of scanning.
- Keep your phone's operating system and browser up to date — most scans just open a link, but staying updated reduces risk further.
Frequently Asked Questions
Can scanning a QR code install malware by itself? On modern phones, simply scanning a QR code just opens a link — the real danger comes from what you do on the page that opens afterward (entering credentials, downloading a file). Still, always check the link first.
Is it safe to scan random QR codes in public? Generally yes, as long as you check the preview link before opening it and stay alert for signs of tampering like an added sticker.
What should I do if I scanned a suspicious QR code? Don't enter any information, close the page, and if you already entered details somewhere, change that password immediately and monitor your accounts.
