QR Code Scams ("Quishing") Internationally: Parking Meters, Menus, and More

QR codes became a normal part of daily payments and menus quickly enough that verification habits haven't caught up — which is exactly the gap this scam exploits.

Physical QR code tampering

Scammers print a fraudulent QR code sticker and place it directly over a legitimate one at a parking meter, restaurant table, or payment kiosk. Scanning it takes you to a fake payment page designed to capture your card details, or redirects a genuine payment to the scammer's account instead of the business or municipality.

• Before scanning at a physical location, check whether the sticker looks layered or slightly raised compared to the surrounding surface — a sign it's been placed over another code.
• After scanning, check that the URL and business name shown match what you'd expect before entering any payment information.
• If a parking payment app or official municipal option is available, use it directly rather than a QR code when possible.

QR codes in emails, texts, and flyers

Because QR codes hide the actual destination URL until scanned, they're increasingly used in phishing emails and texts specifically to bypass link-scanning security tools that check visible URLs. A message might ask you to scan a code to "verify your account," "claim a reward," or "reschedule a delivery."

• Treat a QR code in an unsolicited email or text with the same skepticism as a suspicious link — because functionally, it is one.
• Most phones show a preview of the destination URL before opening it after scanning — check this before tapping through, and don't proceed if it doesn't match the sender's claimed identity.

The pattern to remember

A QR code is just a link in a different format — every instinct you'd apply to a suspicious link (checking the URL, verifying the sender, avoiding entering payment details on unfamiliar sites) applies equally here.

If you've already scanned and entered payment details

Contact your card issuer or bank immediately to flag the account and monitor for unauthorized charges. See the complete international recovery guide for the rest of the process depending on what was shared.

This same underlying mechanic — a scan authorizing a payment rather than confirming one — is also common in UPI-based QR scams in India; see the India-specific version if that's more relevant to your situation. This is one entry in our running field guide to what's actually circulating right now — see Common Scams Right Now (2026): An International Field Guide for the rest.

Curious what's already out there about you? Scan My Shadow checks your phone number and email across 1,500+ sources and sends you a clear report — no guesswork, just facts. Start your scan.