QR codes are everywhere now — on menus, posters, parking meters and packages. They are convenient, but a QR code is just a link you cannot read, which is exactly what scammers exploit. The trick even has a name: quishing, or QR phishing. Our GetMyPassword team explains how to use QR codes safely and avoid the scams hidden inside them.
Why QR codes can be risky
A QR code is simply a link in disguise — you cannot tell where it leads until you scan it. Scammers take advantage by sending you to phishing pages that steal logins or payment details, or to malware. A favorite trick is sticking a fake QR code over a real one on a parking meter, restaurant table or poster, so your scan quietly goes to their page instead.
How to scan safely
- Preview the link first: your phone’s camera shows the URL before opening — read it.
- Check the domain the same way you would any link, watching for odd or lookalike addresses.
- Be wary of stickers: a QR code pasted over another, or on a random flyer, deserves suspicion.
- Never pay or log in on a page reached from a QR code you did not fully trust.
Watch out for payment QR scams
Be especially careful when money is involved. Scammers post QR codes that look like a way to pay a fine, a parking fee or a delivery charge, but actually send your payment — or your card details — straight to them. Pay through official apps and websites you navigated to yourself, not through a code on a sign. If a QR code rushes you to “pay now,” that urgency is the warning sign.
A QR code is a link you cannot read with your eyes, so let your phone read it for you. Preview the address before you open it, and never type a password or pay after scanning a code you cannot fully trust.
Your accounts are the backstop
Even a careful person can be caught by a convincing fake, so make a stolen login useless. Give every account a unique password from our password generator and turn on two-factor authentication; then a password phished through a QR code cannot open your account without the code on your phone. Scan with curiosity, but enter your secrets only on sites you reached yourself.
Frequently asked questions
Are QR codes dangerous?
A QR code itself is just a link, but it can lead to phishing pages, scams or malware, and you cannot see where it goes until you scan it. Previewing the URL and being cautious with stickered or unsolicited codes keeps you safe.
What is quishing?
Quishing is QR-code phishing: scammers use QR codes to send you to fake login or payment pages, often by pasting a fake code over a real one. The defense is to preview the link and avoid entering credentials on untrusted pages.
How do I scan a QR code safely?
Use your phone’s built-in camera, which shows the URL before opening it, and read the domain carefully. Be wary of stickered or random codes, and never pay or log in on a page reached from a QR code you do not fully trust.