What Are QR Code Scams?
Kalamazoo, MI | July 22, 2026
This article at a glance:
- QR Code Phishing ("Quishing") is on the rise in the United States.
- Despite being similar to phishing, quishing is much more effective.
- You can encounter quishing anywhere, digitally or in real life.
QR code scams (also known as “quishing”) are a type of scam that trick you into scanning QR codes that link to harmful content.
Just like with phishing, the goal of a QR code scam is to get you to access a harmful URL on your device. That URL then takes you to a malicious website, which will try to:
Trick you into sharing sensitive financial or personal information
Install a virus on your device
Convince you to send money
Scare you into taking a specific action
Despite QR codes accounting for 26% of all malicious links, most people haven’t even heard of it. And more worryingly, 73% of Americans scan QR codes without verifying that the link isn’t suspicious.
So how does QR code phishing work, and why aren’t more people paying attention to the QR codes they scan?
How Do QR Codes Work?
Most people know that QR codes are similar to the bar codes you scan at grocery stores. And it’s a fair comparison—they’re both patterns that you can scan to access information.
When you think about it, bar codes and QR codes are kind of like a language (just a language we can’t read). The patterns on QR codes are basically a clever way of writing letters and numbers, which the camera on your phone can read and translate into English.
Of course, no one reads novels written in QR code (at least, I’m pretty sure that’s why publishers aren’t buying my book idea). However, QR codes are perfect for writing URLs in a way that devices like your phone can read, making them ideal for quickly accessing websites in the physical world.
Most QR codes contain up to three kilobytes of data, which is enough storage space for 4,296 letters and numbers. That’s enough space to write the Gettysburg Address two and a half times!
How Scammers Create QR Code Scams
Quishing begins when a scammer takes a URL to their harmful website and converts it to a QR code. QR codes are incredibly easy to make, and scammers—just like the rest of us—can just use an online QR code generator in seconds.
Now that the scammer has the QR code, they might send it to you in a regular phishing email. But the smart scammers do something different. Instead, they print it out.
By printing and pasting malicious QR codes onto flyers, parking meters, and gas pumps, scammers put harmful links in the last place you’d expect: the real world.
If it weren’t so evil, it would be genius.
How to Spot Quishing
Every time you think about scanning a QR code in the real world, check for these signs:
1. Tampering.
Check for physical tampering of the QR code. Self-serve machines (like parking meters and gas pumps) might have fake QR codes placed over the real one—if there ever was a real QR code in the first place. Signs of tampering might be:
he QR code that looks newer than the other printed materials on the machine
Leftover tearing from a real QR being removed
The QR is placed over top of a different QR code, as if to conceal it
A “Pay Here” QR code sign printed in a different font than other signage
2. Suspicious URL
Just scanning a QR code shouldn’t take you directly to the linked website. Instead, most QR code apps will show you what the link is before you click it. Always make sure to read the URL before accessing it. Suspicious URLs often (but not always) have red flags like:
Long, random strings of letters and numbers
Wording in the URL that’s different from the advertisement (“get-cheap-bitcoin” on a flyer for cooking lessons)
URLs with words that look legitimate, but actually aren’t (“go0ggle.com” instead of google.com, or “rnicrosoft” instead of microsoft.com.
3. Urgent Messaging
In regular phishing attempts, the urgent messaging you receive is entirely digital: a high-importance email, a notification that says your account is compromised, a fake credit card charge for a large amount of money.
But with QR code phishing, that urgent messaging can appear in the physical world as well, which makes it seem much more real. Stay wary of any QR code you find in real life that you’re told you have to urgently scan, such as:
Parking tickets
“Check-ins” for large, public events like concerts and amusement parks
Flyers in campuses with deals that are “too good to be true”
Protect Yourself from Organizational Quishing
Scammers have the highest success rates when they target groups with a shared cause, like employees and community groups. By dropping a seemingly legit QR code in a break room or a gathering spot, scammers can build quishing campaigns custom-designed to target your organization.
But while you can’t control what scammers do, you can protect you and your business by working with a managed service provider like us at Omega Computer Services. Thanks to our data backups, firewall management, and on-call IT staff, we protect companies across the US from cybersecurity threats everywhere. For more information, click here to contact us today!
