TL;DR: Quishing is phishing carried out through a malicious QR code that, when scanned, leads to a fake website designed to steal information or install malware. Preview the URL before opening it if your phone shows one, avoid scanning QR codes from unsolicited sources, and never enter login or payment details on a page you reached via QR code without verifying the site first.
👉 Check my digital footprint — free 30-second check →
Quishing is phishing carried out through a malicious QR code that, when scanned, leads to a fake website designed to steal information or install malware.
How Quishing (QR Code Phishing) Works
A scammer places a fake QR code sticker over a legitimate one (on a parking meter, restaurant menu, or flyer) or sends one via email or text. Scanning it takes you to a convincing fake login page or triggers a malicious download.
Warning Signs to Watch For
A QR code that looks like it's been stuck over another one, a QR code from an unsolicited email or text, and a resulting webpage that asks for login or payment details unexpectedly.
How to Protect Yourself
Preview the URL before opening it if your phone shows one, avoid scanning QR codes from unsolicited sources, and never enter login or payment details on a page you reached via QR code without verifying the site first.
If this looks similar to something else you've seen, it's worth reading What Is Rental Scams? How It Works and How to Protect Yourself.
This pattern shows up elsewhere too — see What Is Session Hijacking? How It Works and How to Protect Yourself.
Frequently Asked Questions
What is Quishing (QR Code Phishing)?
Quishing is phishing carried out through a malicious QR code that, when scanned, leads to a fake website designed to steal information or install malware.
How does Quishing (QR Code Phishing) typically work?
A scammer places a fake QR code sticker over a legitimate one (on a parking meter, restaurant menu, or flyer) or sends one via email or text. Scanning it takes you to a convincing fake login page or triggers a malicious download.
What are the warning signs of Quishing (QR Code Phishing)?
A QR code that looks like it's been stuck over another one, a QR code from an unsolicited email or text, and a resulting webpage that asks for login or payment details unexpectedly.
How can I protect myself from Quishing (QR Code Phishing)?
Preview the URL before opening it if your phone shows one, avoid scanning QR codes from unsolicited sources, and never enter login or payment details on a page you reached via QR code without verifying the site first.
What should I do if I think I’ve encountered Quishing (QR Code Phishing)?
Stop responding immediately, do not click any links or share information, and report it to the appropriate authority. If money or personal information was already shared, act quickly to secure your accounts and report the incident.