QR Code Phishing (Quishing): How to Verify and Scan QR Codes Safely

QR codes now show up in everyday places, and scammers use them too. The scam has a name, quishing (QR code phishing), and a few habits will help you scan QR codes safely.

Unlike a text link, a printed QR code hides its destination until you scan it. Scammers use that blind spot to cover legitimate codes on signs, parking meters, and restaurant tables with their own.

Here’s how quishing works, how to spot a tampered code, and how to scan QR codes safely.

---

1. What Is Quishing? How Scammers Exploit QR Codes

In a quishing attack, a scammer replaces a legitimate QR code with a fraudulent one that:

• Sends people to a fake login page built to steal credentials (often copying banks, shipping services, or utility providers).
• Triggers an automatic malware download.
• Opens an unsecured billing form to steal credit card data.

Email filters have a harder time inspecting a link inside an image than a link in text, so quishing also shows up in phishing emails sent to companies.

---

2. Visual Signs of Tampered QR Codes

Before scanning a code in public, take a few seconds to look at it:

• The sticker test: Run a finger over the poster or sign. If the QR code is a sticker pasted on top of the printed page, ask staff whether it’s genuine.
• Mismatched branding: Check whether the colors, fonts, and alignment of the QR frame match the rest of the billboard or sign.
• Low print quality: A blurry, low-resolution code on an otherwise sharp sign is a warning sign.

---

3. How to Scan QR Codes Safely

These habits protect your personal data:

1. Turn off auto-open: Set your camera or scanner app to show the URL first instead of opening it straight away.
2. Check the domain: Read the domain closely and look for small misspellings (e.g., pay-qranalytica.com instead of qranalytica.com).
3. Don’t pay through an unverified code: Never enter payment details on a page you reached from a public QR code until you’ve confirmed it uses HTTPS and a domain you trust.

---

4. Using a QR Validator Tool

If a QR code arrives in an email, or you want to check an image file before printing it for your own campaign, run it through the Free QR Validator Tool.

The validator decodes the URL and checks it for warning signs: no HTTPS, lookalike brand domains, link shorteners that hide the real destination, raw IP addresses, and unusual domain endings. It then gives the link a security score.

---

Secure Your Campaigns

If you print QR codes for your business, your customers have to trust them. Create them on a platform that supports custom branded domains, so every scan shows your own domain and a lookalike swap is easier for customers to spot.