Fake QR Codes (Quishing): How to Stay Safe
A QR code is a link you can't read. That's what makes it convenient, and it's exactly what scammers exploit. A sticker on a parking meter, a "missed delivery" letter, a payment request on WhatsApp: the code looks the same whether it's genuine or a trap.
In this guide
What quishing is
"Quishing" combines QR and phishing. Instead of a suspicious link in an email, the scammer hides the link inside a QR code. Because people can't see where a code leads, and because many email filters don't analyse images, quishing can slip past both humans and security tools.
Fake codes can lead to:
- Phishing pages that copy a bank, parking company, delivery service or Microsoft/Google login.
- Payment requests that take money from you instead of sending it.
- Malicious app downloads or prompts to install "security updates".
- Fake WiFi networks, in rarer cases, which put you on a network controlled by someone else.
Common real-world tricks
Parking and EV charging stickers
Scammers place stickers over the real code on parking meters or charging stations. The fake page looks like a payment portal and collects card details. Councils and police in several countries have warned about this.
"Scan to receive money"
A common scam in UPI-using countries like India: a "buyer" on a marketplace sends a QR code and says "scan to receive payment". Scanning a UPI QR code and entering your PIN sends money; you never need to scan or enter a PIN to receive money.
Fake delivery or tax letters
Physical letters or emails claim a parcel is waiting or a refund is due and ask you to scan a code to "confirm details".
Restaurant and café menus
A sticker over a table's menu or WiFi code leads to a phishing page or asks for card details before you've ordered.
Email with a QR code to "re-verify your account"
Workplace phishing often uses codes that lead to fake Microsoft 365 or Google login pages, aimed at stealing work passwords.
Fake WiFi codes in public places
A code labelled "Free WiFi" could connect you to a network the scammer controls, or open a fake "WiFi login" page asking for an email password or card number. Genuine venue WiFi rarely needs more than accepting terms.
Warning signs
- The code is a sticker on top of another code or slightly misaligned.
- The link preview shows a misspelled domain, an unusual ending, a URL shortener or an IP address.
- The page asks for passwords, OTPs, card numbers or UPI PINs right away.
- There's urgency: "pay in 10 minutes or receive a fine".
- Someone asks you to scan a code to receive money.
- A "WiFi" code opens a website instead of offering to join a network.
- The code arrived unexpectedly by email, SMS or chat.
Safe scanning habits
- Read the preview. iPhone and Android cameras show the domain before opening. Take two seconds to read it.
- Prefer the official route. Type the bank, parking or delivery company's website yourself, or open their official app.
- Check physical codes. Run a finger over the code; if it's a sticker on a sign, be cautious.
- Never enter a UPI PIN to receive money.
- Don't install apps from QR links. Get apps from the Play Store or App Store by searching for them.
- Use security features: keep your phone updated, use your browser's safe browsing protection, and turn on two-factor authentication for important accounts.
- Use a scanner that shows content first. A scanner that displays the text or URL and lets you decide is safer than one that opens links automatically.
WiFi QR codes specifically
A genuine WiFi QR code contains only WIFI: followed by the network name, type and password. It cannot install anything on its own. Still, check before you join:
- Compare the network name with what staff or signs say. If a café says "BlueBean_Guest" and the code offers "Free_Public_WiFi", don't join.
- If a "WiFi" code opens a website, it's not a WiFi code. Close it.
- On public networks, avoid banking or entering sensitive details on sites, and check for the padlock/HTTPS.
- Forget networks you joined once and don't need, so your phone doesn't auto-join lookalikes later.
On Android, Wifi QR Connect scans WiFi QR codes and keeps a scan history stored locally on your device, which helps you review what you've scanned. It also creates WiFi QR codes, shares hotspots by QR, runs a download/upload speed test and shows current WiFi connection info, so after joining you can confirm the network name you're actually on.
For more on WiFi code risks, read Is It Safe to Share WiFi With a QR Code?.
Advice for businesses
If you display QR codes for menus, payments or WiFi:
- Print codes directly on cards and signs rather than using stickers.
- Check codes daily for tampering.
- Display your domain or network name next to every code so customers can verify.
- Use your own domain for menu links, not random shorteners.
- Train staff to answer "which WiFi is ours?".
There's a full setup guide in WiFi QR Code for Restaurants and Cafes and WiFi QR Codes for Offices and Events.
What to do if you've been caught
Act quickly:
- Card details entered: call your bank immediately using the number on your card, block the card and ask about disputing charges.
- UPI or bank payment: contact your bank and payment app support right away. In India, report cyber fraud to the national cybercrime helpline 1930 or at cybercrime.gov.in. Other countries have their own reporting channels, such as Action Fraud in the UK or the FTC in the US.
- Password entered: change it on the real website immediately, and anywhere else you used the same password. Turn on two-factor authentication.
- App installed: uninstall it, run Play Protect or your phone's security scan, and check which apps have accessibility or device admin permissions.
- Fake WiFi joined: disconnect, forget the network and change passwords for any accounts you logged into while connected.
- Report the code to the business or authority whose sign was tampered with.
Teaching family members
Older relatives and kids are frequent targets. Three simple rules are easy to remember:
- "Read where it goes before you open it."
- "Never enter a PIN to receive money."
- "If it's urgent and scary, stop and call someone."
FAQ
Can scanning a QR code hack my phone?
Scanning alone rarely does harm. The danger is what you do next: opening a phishing page, entering details, paying or installing an app. Keep your phone updated and check the link before acting.
How can I tell if a QR code is fake?
Look for stickers over original codes, check the link preview for odd domains, and be suspicious of pages asking for passwords, card details or PINs straight away.
Do I need to scan a QR code to receive money on UPI?
No. Receiving money never requires scanning a code or entering your UPI PIN. Anyone asking you to do this is likely trying to scam you.
Are WiFi QR codes dangerous?
Genuine WiFi codes only contain network details. The risk is joining a fake network, so check that the network name matches what the venue displays.
What should I do after scanning a scam QR code?
If you entered details or paid, contact your bank immediately, change affected passwords and report the fraud to your local cybercrime authority.