QR Code Scams

What it is

QR code scams, sometimes called "quishing", use QR codes to direct victims to malicious websites. Because the destination is hidden inside an image, these codes often slip past email security filters and exploit the trust people place in scanning a code with their phone. They appear in emails, letters, posters, parking meters and fake stickers placed over legitimate codes.

How it works

1. 1

   A QR code is placed in a phishing email, a physical sticker over a real code, or an official-looking notice.

2. 2

   The victim scans it with their phone, which feels routine and safe.

3. 3

   The code opens a convincing fake login, payment or app-install page.

4. 4

   The victim enters credentials or card details, or installs a malicious app.

5. 5

   Because the action happens on a personal phone, it often bypasses corporate security controls entirely.

Business impact

• Stolen credentials and account takeover
• Fraudulent payments from personal or business cards
• Malware installed on mobile devices used for work
• A route around email and network security controls

How to defend against it