QR codes are everywhere now. We scan them for restaurant menus, event check-ins, Wi-Fi access, parking payments, even to download apps. They’re fast, familiar, and nobody thinks twice about pulling out their phone to scan one.
That’s exactly the problem. The familiarity that makes QR codes convenient is the same thing that makes them useful to scammers.
A fraudulent QR code can look completely ordinary while quietly sending you somewhere you never intended to go — a fake login page, a bogus payment form, a site built to steal your credentials or talk you into downloading something you shouldn’t. This kind of scam has picked up a name of its own: quishing, or phishing via QR code.
How the scam actually works
It’s a simple trick, mechanically. A scammer generates a QR code that points to a fraudulent website, then places it somewhere people are likely to scan it without thinking — a parking meter, a flyer, a restaurant table, a delivery notice, a business card, even a fake “payment overdue” notice. Sometimes they’ll simply stick a sticker with their own code directly over a legitimate one.
The code itself isn’t the dangerous part. What matters is where it takes you. A well-made scam site can look nearly identical to a bank’s login page, a government portal, or a delivery company’s tracking page. You scan, the page opens, and it asks you to confirm your account, verify your identity, or pay a balance that’s supposedly overdue. Nothing about the request feels out of place — which is exactly why people fall for it. Whatever you type in goes straight to the scammer.
Why QR codes work so well on people who’d normally catch a phishing email
With a regular link, most of us have some instinct to glance at the web address before clicking. A QR code skips that step entirely — you point your camera at it and the destination opens, often without you seeing the URL first. That missing moment of friction is exactly what makes these scams effective. There’s no address to eyeball, no chance to pause, just a code and a redirect.
A legitimate location doesn’t make the code legitimate
This is worth sitting with for a second. A scammer doesn’t need to build an entire fake environment to pull this off — they just need thirty seconds and a sticker.
Picture a parking payment machine. It looks official because it is official. But if someone has placed a fraudulent sticker over the real QR code, the machine is genuine, the location is genuine, and the code is not. The same trick works on posters, signage, and printed notices anywhere the public interacts with them. The lesson here: don’t judge a QR code by where you found it.
What to do before you scan
You don’t need to swear off QR codes — just treat them with the same skepticism you’d give an unexpected link.
Ask whether you were expecting it. If a QR code shows up somewhere you weren’t anticipating, or someone hands you one out of nowhere, pause and ask why. Does the request even make sense in context?
Look at the code itself. Does it look like a sticker slapped over something else? Is it damaged, crooked, or out of place compared to everything around it? These are small details, but they’re often the only warning you get.
Check where it’s actually taking you. Many phones will show the destination URL before opening it — take that extra second to read it. Watch for misspelled domains, oddly long or convoluted addresses, or a site that just doesn’t match the organization you expected. And don’t be reassured by a padlock icon or “https” in the address bar; scam sites use encryption too. It proves the connection is private, not that the site is trustworthy.
Don’t hand over sensitive information because a QR code asked for it. If scanning a code lands you on a page requesting your banking password, card number, or account credentials, stop there. Close it, and go to the organization’s app or website the way you normally would — type in the address yourself rather than trusting the one the code gave you.
Slow down around payments especially. QR codes are an easy way to redirect money somewhere other than where you meant to send it. Before paying anything, make sure you actually know who you’re paying, how much, and where the money is going. If any of that feels unclear, stop and verify through a different channel before you proceed.
QR codes in email are still just links
This deserves its own mention because it’s becoming a real blind spot for businesses. Most employees have been trained to be wary of suspicious links in email — but a QR code slips past that training entirely, even though it’s doing the exact same job.
An email might ask someone to scan a code to verify their Microsoft 365 account, reset a password, review a document, or confirm a payment. Because the malicious link is hidden inside an image rather than sitting in plain text, the email itself often looks unremarkable. Nothing to click, nothing obviously suspicious — just a code. Don’t let that fool you. It’s still a link. It’s just wearing a disguise.
If you’ve already scanned something suspicious
Don’t panic — scanning a code isn’t the same as being compromised. What matters is what happened afterward.
If you scanned it and closed the page without entering anything or downloading a file, your exposure is probably minimal. But if you typed in a password or financial details, act quickly: change that password through the organization’s real website or app, turn on multi-factor authentication wherever it’s available, and reach out to the organization directly if account or financial information may be at risk. If this happened on a work device, loop in your IT team right away so they can assess what else might need attention.
The takeaway: a QR code is just a link wearing a costume
There’s nothing inherently dangerous about the technology itself. The risk comes from how comfortable we’ve gotten treating QR codes as automatically trustworthy, simply because they’re convenient and everywhere.
At MH3, we talk to organizations a lot about layered security — spam filtering, multi-factor authentication, endpoint protection, and solid policies all matter. But none of that replaces a moment of basic human skepticism. Before you scan, ask yourself: did I expect this? Do I know where it came from? Is it asking me for something it has no business asking for?
If the answer isn’t clear, don’t scan it. That’s really the whole strategy.
