QR Code Security Risks, Scams, and Safe Scanning Practices

QR codes have quietly become one of the most used interfaces on the planet menus, parking meters, boarding passes, payment terminals, even product packaging. That convenience is exactly what attackers are counting on. Because a QR code hides its destination until after you've already scanned it, it's the perfect delivery mechanism for a phishing link, and criminals know it.

The numbers back this up. Microsoft's Q1 2026 email threat analysis, which reviewed more than 8.3 billion phishing threats, found that QR-code-based phishing commonly called "quishing" had surged 146% as attackers shifted tactics to dodge traditional filters. Separately, quishing now accounts for roughly 12% of all phishing attacks globally, up from under 1% just a few years ago, and one telemetry source from Palo Alto Networks Unit 42 logs more than 11,000 malicious QR code detections every single day.

This guide breaks down exactly how malicious QR codes work, walks through real world cases that made headlines, and gives you a practical, no-jargon checklist for scanning safely whether you're checking a restaurant menu or approving a payment. If you want to verify a code before you commit to opening it, our QR Scanner tool decodes the destination URL first, and our QR Testing tool lets you validate a code's safety and structure before it ever reaches a customer.

What Makes QR Codes a Security Risk
How QR Code Scams Actually Work
Real World QR Code Attacks
Common QR Code Attack Methods
Warning Signs of a Malicious QR Code
QR Phishing vs. Traditional Phishing
Mobile Security Best Practices
The Safe QR Code Scanning Checklist
Built In Camera vs. Dedicated Scanner App
What to Do If You Scanned a Malicious QR Code
QR Code Security for Businesses
Frequently Asked Questions

What Makes QR Codes Security Risks

A QR code is just a container. It can hold a URL, a contact card, a WiFi password, or payment instructions, and your phone's camera decodes that container instantly. The risk isn't the technology itself it's that a QR code is unreadable to the human eye until after a device has already processed it.

With a normal link, you can hover over it, glance at the domain, and decide whether it looks right. With a QR code, you're trusting a black and white grid that could point anywhere. Security researchers describe this as the structural problem behind quishing: human eyes cannot verify the destination before scanning, and most email and web security tools were built to scan text, not pixel patterns inside an image.

Three factors compound this risk:

Trust by default. A decade of legitimate use menus, vaccine cards, boarding passes has trained people to scan first and question later. Survey data from NordVPN and KnowBe4 found that 73% of users scan QR codes without checking where the link goes.
Visual indistinguishability. A 2023 Ivanti survey found 71% of consumers cannot tell a legitimate QR code from a malicious one just by looking at it. They look identical there's no version of a QR code that "looks safer."
Detection gaps. Corporate email security tools inspect headers, parse text, and check links against blocklists. None of that works when the malicious URL exists only as pixel data inside an image, which is exactly why attackers have shifted toward this method. Cyble's research on QR bearing phishing PDFs found that roughly 80% had zero detections on VirusTotal the first time they were scanned.

How QR Code Scams Actually Work

Most QR code scams follow the same basic shape as any phishing attack the delivery mechanism is just different. Here's the typical sequence:

The lure. You receive an email, text, flyer, sticker, or social media post with a QR code and a reason to scan it: "verify your account," "claim your refund," "scan to pay," "complete this delivery."
The scan. You open your camera or a scanner app and point it at the code. This step is where the danger really begins, because your phone is now decoding instructions from a source you haven't verified.
The redirect. The code resolves to a URL often a lookalike domain designed to mimic a real service (a parking app, a bank login, a Microsoft 365 page).
The harvest. You're prompted to log in, enter payment details, or download something. Whatever you enter goes straight to the attacker.
The exploit. Stolen credentials get used for account takeover, fraudulent payments, or increasingly to bypass multi factor authentication by proxying your session in real time as you log in.

What makes this especially effective on mobile is that step 2 typically happens on a personal phone, completely outside any corporate firewall, endpoint protection, or web filtering that might have caught the same link in a work email.

Real World QR Code Attacks

Theory aside, here are documented cases that show how these attacks play out in practice.

Parking Meter Sticker Scams (Multiple U.S. Cities, 2023–2026)

The FTC first warned the public in December 2023 about scammers covering legitimate QR codes on parking meters with their own stickers. The pattern has since repeated across dozens of cities:

In Fort Lauderdale, city workers found fraudulent stickers some displaying the real ParkMobile logo at seven parking locations, redirecting victims to sites built to steal banking information.
In Redondo Beach and San Clemente, California, scammers placed fake codes on roughly 150 meters, glued directly next to the legitimate ParkMobile and PayByPhone labels. One victim in San Clemente entered his card number on a spoofed site; his wife's credit card company called about unauthorized charges within two minutes.
In Honolulu, Baltimore, and Atlanta, similar sticker campaigns redirected drivers to lookalike domains such as "poi2park.com" mimicking the legitimate "pay2park.com."

The pattern is consistent: a sticker placed over real signage, a URL that's one or two characters off from the genuine site, and a payment form that looks convincing enough to fool someone in a hurry.

Microsoft 365 Credential Theft via QR Code

Security vendors have tracked multiple waves of QR phishing campaigns aimed at corporate Microsoft 365 users. Employees receive an email styled as an HR notice, a voicemail alert, or an "important document" waiting in their account that replaces the usual clickable link with a QR code. Scanning it leads to a fake Microsoft login page. In one case study involving a large U.S. energy company, 29% of more than 1,000 analyzed emails contained malicious QR codes, using the same urgency tactics ("verify your account now") that drive traditional phishing.

A more advanced variant embeds the QR code inside a PDF attachment. Scanning it routes the victim through a URL designed to steal active session tokens, which then redirects to a convincing Microsoft sign-in page meaning even users with MFA enabled can have their session hijacked if they don't notice the detour.

Nation State Spearphishing via QR Code

In January 2026, the FBI issued a flash alert reporting that Kimsuky, a threat group affiliated with North Korea, was targeting U.S. think tanks, academic institutions, and government entities using QR codes embedded in spearphishing emails. These campaigns consistently ended in session token theft and real time MFA bypass via adversary in the middle proxying a far more sophisticated outcome than simple credential theft.

Split and Nested QR Code Campaigns

In March 2026, researchers documented a quishing campaign that delivered phishing emails in three waves, none of which were blocked by security tooling the emails passed SPF, DKIM, and DMARC authentication and encoded the malicious URL inside BMP image attachments, making it invisible to text based scanners. The same research tracked the broader campaign at over 1.6 million emails sent across organizations. Other vendors have since documented "split" QR codes, where the malicious payload is fragmented across multiple images or document pages specifically to evade automated, single image scanning.

Common QR Code Attack Methods

Attack Method	How It Works	Where You'll Encounter It
Sticker overlay	A fraudulent QR sticker is physically placed over a legitimate code	Parking meters, transit signage, restaurant tables
Quishing (email/PDF)	A malicious QR code is embedded in an email body, image, or PDF attachment to bypass text-based filters	Corporate inboxes, fake HR/IT/payroll notices
Lookalike domain redirect	The code resolves to a URL nearly identical to a real one (e.g., one swapped letter)	Payment pages, login portals
Session token theft / MFA bypass	The destination page proxies your login in real time, capturing your session even after MFA	Fake Microsoft 365, Google Workspace logins
Malware/app installation prompt	The code prompts an app download outside official app stores	Fake "scan to claim" or "scan to update" prompts
Payment redirection	The code substitutes a legitimate payment QR (restaurant, charity, vendor) with one pointing to the attacker's own account	Donation boxes, restaurant tables, invoices
Split/nested encoding	The malicious payload is broken across multiple QR codes or document pages to dodge automated single-image scanning	Multi-page PDFs, document attachments

Warning Signs of a Malicious QR Code

You usually can't tell a malicious QR code from a legitimate one just by looking at the pattern itself but the context around it almost always leaves clues:

It's a sticker, not a print. Official signage is printed as part of the material. If a code is on a separate sticker, label, or piece of paper stuck on top of something else, treat it as suspicious by default.
It arrived unexpectedly. A QR code that shows up in an unsolicited email, text, or social media DM especially with urgent language like "verify now" or "your account will be suspended" is a classic phishing setup, regardless of delivery method.
The preview URL looks off. Both iOS and Android show a preview of the destination URL before opening it. Watch for misspellings, extra words, swapped letters, or an unfamiliar domain extension.
It skips the official app. If a code asks you to enter payment or account details directly in a browser instead of taking you to a recognized, installed app, that's a red flag especially for parking, tolls, and payments.
It demands urgency. Scarcity and urgency ("scan within 10 minutes," "immediate action required") are behavioral manipulation tactics borrowed straight from traditional phishing.
It's oddly placed. A code taped over an existing one, positioned at an angle, or appearing somewhere a code wouldn't normally be (like inside a "free WiFi" flyer on a public bulletin board) deserves a second look.
No verifiable source. A legitimate business QR code usually has a name, logo, or context that you can independently verify. If there's nothing to confirm who created it, don't trust it on faith.

Before opening any link that came from a code you're unsure about, run it through our QR Reader tool to see the decoded destination and basic safety signals without exposing your device.

QR Phishing vs. Traditional Phishing

Factor	Traditional Phishing	QR Phishing (Quishing)
Delivery format	Plain-text hyperlink	Image encoded QR code
Detectable by email filters?	Often yes URLs can be scanned and blocklisted	Often no most filters parse text, not embedded image data
Where it's typically opened	Same device that received it (often a managed work computer)	Usually a personal mobile phone, outside corporate security controls
Preclick visibility	Can hover to preview the URL before clicking	Destination is hidden until the code is scanned
Common goals	Credential theft, malware delivery	Credential theft, MFA/session token bypass, payment fraud
Growth trend (2023–2025)	Relatively stable	Up roughly 400–587% by several industry measures
Physical world variant	Rare (e.g., fake login pages via USB drops)	Common stickers over real codes in public spaces

The underlying goal is identical in both cases. What changes is the delivery mechanism and that single change is enough to slip past defenses built for a different era of phishing.

Mobile Security Best Practices

Because most QR scanning happens on personal phones, your mobile security habits matter as much as the scan itself.

Keep your OS and apps updated. Security patches close vulnerabilities that malicious redirect chains rely on.
Use a scanner that previews URLs. Your phone's built in camera app typically shows the destination link in a banner before opening it read it before tapping "open."
Avoid scanning codes on public WiFi when possible. If you must use public WiFi for a payment-related scan, use a VPN or switch to cellular data first.
Don't auto grant permissions. If scanning a code triggers an app install or a permissions request you didn't expect (camera, contacts, SMS access), decline and close out.
Separate work and personal scanning habits. A QR code in a work email deserves the same scrutiny as a work email link don't let "it's just a QR code" lower your guard.
Enable phishing resistant authentication where available. Passkeys and FIDO2 based MFA are far more resistant to the real-time session-proxying techniques used in advanced quishing kits, compared to SMS codes or app-based one-time codes.
Check before you pay. For any QR initiated payment, confirm the receiving account or merchant name matches what you expect before confirming the transaction.

The Safe QR Code Scanning Checklist

Run through this before scanning any code you don't already trust:

Inspect it physically. Is it printed as part of the original material, or does it look like a sticker placed on top?
Check the source. Did this code arrive unexpectedly via email, text, or social media? Be extra cautious.
Preview before opening. Use your camera's built in preview or a tool like QR Scanner to see the destination URL first don't tap "open" blindly.
Read the URL carefully. Look for misspellings, extra characters, or unfamiliar domains mimicking a real brand.
Verify HTTPS. A legitimate site should use a secure connection but remember, HTTPS alone doesn't guarantee legitimacy, since attackers can get certificates too.
Avoid entering sensitive info immediately. If a scanned page asks for a password or card number right away, pause and verify independently (e.g., by typing the company's known URL manually).
Use official apps when available. For parking, payments, or transit, prefer the verified app over a browser based QR flow.
Don't install anything from a scan. Legitimate services rarely require an APK or out of store app install triggered by a QR code.
When unsure, don't scan. If something feels off placement, urgency, unfamiliar branding it's fine to walk away and find another way to get what you need.

Built In Camera vs. Dedicated Scanner App

Feature	Phone's Built In Camera	Dedicated Scanner App (e.g., QRScannerAI)
URL preview before opening	Yes (standard on iOS/Android)	Yes, often with added context
Malicious link/domain checks	No	Often yes, depending on the app
Scan history tracking	Limited or none	Usually available
Batch or repeated scanning	Manual, one at a time	Often streamlined for frequent use
QR code generation/testing	Not supported	Supported in dedicated tools
Offline use	Yes	Depends on app
Best for	Quick, low stakes everyday scans	Verifying unfamiliar or higher stakes codes before opening

Your built in camera is perfectly fine for scanning a known restaurant menu. For anything involving payment, login credentials, or a code from an unverified source, a tool that decodes and previews the link first like QR Reader adds a meaningful layer of protection.

What to Do If You Scanned a Malicious QR Code

If you've already scanned a code and something feels wrong or you entered information on a page that turned out to be fake act quickly:

Disconnect from the network if you suspect malware was installed, to limit potential data exfiltration.
Change any passwords you entered on the page, starting with the affected account, then any account using the same password elsewhere.
Contact your bank or card issuer immediately if you entered payment details. Ask about freezing the card and reviewing recent transactions.
Enable or check MFA on the affected account, and consider switching to a passkey if available.
Run a security scan on your device to check for malware, especially if you downloaded anything after scanning.
Report the scam. In the U.S., file a report at ReportFraud.ftc.gov and, if it involves a cybercrime component, at the FBI's IC3.gov. Also notify the legitimate business being impersonated (e.g., a parking app or bank) so they can warn other users.
Monitor your accounts for several weeks afterward fraudulent activity doesn't always show up immediately.

QR Code Security for Businesses

If your business uses QR codes for menus, payments, marketing, or ticketing you're part of the trust chain attackers exploit. A few practical steps:

Use tamper evident placement. Embed codes directly into printed materials rather than relying on stickers or labels that can be covered.
Monitor your codes. Dynamic QR codes (which can be edited and tracked after printing) let you detect unusual redirect patterns and disable a compromised code instantly something static codes can't do.
Audit codes regularly. Periodically scan your own deployed codes in the field to confirm they still resolve to the correct destination, especially in public, unsupervised locations.
Test before you deploy. Before printing or publishing a new QR code, validate its structure, encoded content, and resolved destination with a tool like QR Testing to catch errors or unintended redirects before customers ever see it.
Educate customers and employees. A short, visible note ("Always verify our domain name before entering payment info") can meaningfully reduce successful spoofing of your brand.
Train staff to recognize quishing. Since a large share of quishing specifically targets corporate inboxes with fake HR, IT, or payroll notices, frontline awareness training measurably reduces click through rates.

Frequently Asked Questions

Are QR codes inherently dangerous? No. A QR code is just a container for data usually a URL. The risk comes from not being able to see that destination until after scanning, combined with how easily a code can be swapped, faked, or hidden inside a phishing email.

Can a QR code install malware just by scanning it, without me clicking anything else? On modern, patched phones, simply scanning a code typically only opens a link preview it doesn't execute code on its own. The real danger comes after the scan: visiting a malicious site, downloading a fake app, or entering credentials on a spoofed page. Older or unpatched devices can be more vulnerable to exploits triggered by the resulting redirect.

How can I tell if a QR code has been tampered with? Look for physical signs first a sticker placed over existing signage, odd positioning, or a code that looks newer or lower quality than the surrounding material. Then check the resolved URL for misspellings or an unfamiliar domain before entering anything.

Why are QR code scams increasing so quickly? Several forces are converging: most email security tools were built to scan text, not images, so QR codes slip past filters that would catch the same link in plain text. At the same time, years of legitimate use have trained people to scan without thinking twice, and QR based payments have become mainstream worldwide.

Is it safe to scan a QR code on public WiFi? It adds risk, mainly around data interception, separate from the QR code itself. Where possible, use cellular data or a VPN for any scan involving payment or login information.

What's the difference between phishing and quishing? Quishing is phishing delivered through a QR code instead of a clickable text link. The end goal stealing credentials, payment details, or installing malware is identical; only the delivery mechanism differs, which is precisely what helps it bypass traditional, text based security filters.

Can dynamic QR codes be safer than static ones? They can be more manageable from a security standpoint, since the underlying destination can be monitored and changed after printing meaning a compromised dynamic code can be disabled instantly. A static code's destination is fixed forever once printed, for better or worse.

Should I avoid QR codes altogether? That's not necessary or realistic given how widely they're used. The practical approach is to apply the same scrutiny you'd give a text link: check the source, preview the destination, and avoid entering sensitive information on a page you can't verify.

Final Takeaway

QR codes aren't going anywhere, and they don't need to be treated as universally dangerous but they do need to be treated with the same healthy skepticism you'd apply to any unfamiliar link. The single highest leverage habit is also the simplest: preview the destination before you open it, every time. Combine that with awareness of common attack patterns sticker overlays, urgent emails, lookalike domains and you eliminate the vast majority of real world QR scams before they ever get a chance to work.

For an extra layer of confidence, use QR Scanner to preview links before opening them, QR Reader to decode and inspect any code you're unsure about, and QR Testing to validate your own codes before sharing them publicly.

Can't find what you need?