Skip to content
Scanlexa

QR Code Scams (Quishing): How to Stay Safe

· 2 min read · Scanlexa team

"Quishing" (QR code phishing) is a scam where criminals use a QR code to send you to a fake website or a fraudulent payment. Because you can't read a QR code by looking at it, it's easy to hide a bad link behind one.

How the scams work

  • Stickers over real codes. A fake code is stuck over the real one on a parking meter, a restaurant table or a payment poster.
  • Fake payment codes. A code that shows someone else's bank account, so your transfer goes to the scammer.
  • Phishing emails and letters. "Scan to verify your account", "Scan to avoid a fine", sending you to a fake login page that steals your password.
  • Fake delivery notices. A card claiming a parcel is waiting, with a code to "reschedule" that asks for card details.

Warning signs

  • The code is a sticker on top of another code, or looks tampered with.
  • After scanning, the website address looks wrong: misspelled, a strange domain, or not the company's real site.
  • The page asks for a password, PIN, OTP or card details straight away.
  • There's pressure to act now: a fine, a deadline, a locked account.
  • For payments, the account name in your bank app doesn't match the business.

How to scan safely

  1. Look before you tap. Most phones show the link before opening it. Check the website name.
  2. Use a scanner that shows the content first. Our QR code scanner shows the full link and highlights the website name before anything opens.
  3. Never enter a PIN, OTP or password on a page you reached from a QR code you didn't expect.
  4. For bank transfers, check the account name in your banking app before confirming.
  5. If in doubt, type the address yourself or call the company on a number you already know.

What businesses can do

  • Use codes from a provider that checks links. Scanlexa checks every dynamic-code destination against Google Web Risk before saving it, and blocks unsafe links.
  • Laminate and inspect printed codes regularly, especially in public places.
  • Put your name or logo in the frame, so a plain sticker over it stands out.
  • Use one official code and tell customers which it is.
  • Report fakes. Every page we host has a "Report this page" link, and you can report any Scanlexa code that's being misused.

Lost money?

Contact your bank immediately: the sooner they know, the better the chance of stopping the transfer. Then report it to the police.

Keep reading