QR Code Safety: How to Spot Fake QR Codes & Stay Safe in 2026

The Rise of QR Code Phishing ("Quishing")

In 2024 and 2025, security researchers documented a sharp increase in attacks using malicious QR codes — a technique now widely called "quishing" (QR code phishing). By 2026, it's one of the most common social engineering vectors, and the numbers are still climbing. Microsoft's Q1 2026 email threat report, drawn from more than 8.3 billion analysed phishing threats, recorded QR code phishing rising from 7.6 million detections in January to 18.7 million in March — a 146% increase across a single quarter.

The reason is simple: most people have been trained to be suspicious of links in emails, but still instinctively scan physical QR codes without thinking. Attackers exploit this blind spot by placing fake QR codes in public spaces, sending them via mail, or embedding them in legitimate-looking PDFs and emails.

That last route is now the dominant one. In the same Microsoft data, PDF attachments carried 70% of QR code phishing by March, up from 65% in January. Burying the code in an attachment moves the link out of the message body — where automated link-checking usually happens — and onto a second device, your phone, which your employer may not be protecting at all.

Real-World Quishing Attacks

Each common scam has its own tell and its own fix, and we cover the four people ask about most in a guide of their own:

• A sticker on a parking meter: how to check the code in fifteen seconds before you pay, and what to do if you already paid.
• A parcel you did not order, with a QR code inside: the brushing scam, whether to keep or return the goods, and what not to do with the code.
• A gift card whose barcode has been swapped: the one check at the counter that actually catches it.
• A delivery message with a tracking number: what the number’s check digit can confirm, and why passing it still proves nothing.

Here are the documented attack patterns behind them, and a few more:

Parking Meter QR Code Scams

Attackers place fake "Pay Here" QR code stickers over legitimate ones on parking meters and kiosks. The fake code leads to a cloned payment page that steals your credit card details. This has been documented in cities across the US, UK, and Australia. Our parking meter guide walks through the check step by step.

Restaurant Menu Replacement

A malicious actor places their own QR code on restaurant tables, directing diners to a fake menu page that captures credentials or installs malware.

Package Delivery Phishing

Fake "missed delivery" notices with QR codes arrive by mail. The code leads to a realistic delivery company login page that harvests account credentials.

A separate variant sends a real parcel. Cheap goods nobody ordered arrive with a card saying to scan a code to find the sender or register the gift — a brushing scam with a phishing payload attached, and the subject of an FBI advisory. See what to do about an unexpected package with a QR code.

Fake IRS Notices

The IRS added QR code phishing to its 2026 "Dirty Dozen" list of the year's most dangerous tax scams, alongside AI-assisted impersonation and convincing replica IRS websites. The scam arrives as a letter or message styled as an official notice, with a QR code that leads to a counterfeit site harvesting Social Security numbers, credentials and financial account details.

This one comes with an unusually clean rule attached, which is what makes it worth knowing: the IRS has stated that it does not use QR codes in its official correspondence. A QR code on something claiming to be an IRS notice is therefore not a code to inspect carefully — it is the tell. The same applies to any unsolicited message asking you to scan in order to verify an account or claim a refund.

Email-Based Quishing

Attackers embed QR codes in emails to bypass email security filters, which typically scan links but may not decode QR code images. The QR code leads to a phishing page.

How to Identify Suspicious QR Codes

Train yourself to check these warning signs before scanning any QR code:

Physical QR Codes

• Check for stickers over stickers — lift the corner of any QR code sticker to see if it's covering another one underneath
• Look for poor print quality or misalignment — legitimate business QR codes are usually professionally printed, not hastily applied stickers
• Verify with staff — if a QR code is asking for payment, confirm with an employee that it's legitimate
• Match the branding — does the QR code match the rest of the signage? An off-brand sticker is suspicious

Digital QR Codes (in emails/PDFs)

• Unsolicited messages — treat QR codes in unexpected emails the same way you'd treat suspicious links
• Urgency language — "Scan now or your account will be suspended" is a red flag
• Sender mismatch — check that the email domain matches the claimed organization

Before You Scan: What to Check

A good QR scanner app will show you the destination URL before opening it. This is the single most important safety feature. Here's what to look for in the preview URL:

• Domain mismatch — does the URL domain match where you expect to go? paypa1.com vs paypal.com
• Shortened URLs — bit.ly, tinyurl, and similar services hide the real destination. Be cautious with shortened URLs from unexpected sources
• HTTP vs HTTPS — legitimate sites use HTTPS. A QR code leading to a plain http:// URL for a financial or login page is suspicious
• Random-looking domains — xk7f2.netlify.app is unlikely to be a legitimate business site
• Unusual file types — a QR code that immediately triggers a file download (.apk, .exe, .zip) is almost certainly malicious

If the preview URL looks plausible but you are not certain, paste it into our QR code link checker. It names the domain the link actually resolves to and flags the tricks used to disguise it — an @ in the address, a lookalike domain built from Cyrillic characters, a redirect hidden in a query parameter. It runs entirely in your browser, so the link is never sent anywhere.

How Scan & Generate Protects You

Scan & Generate is designed with safety in mind:

• URL preview before opening — the app shows you the full decoded URL and asks for confirmation before launching any link in a browser
• Scan history — every scan is logged locally so you can review what you've scanned
• No auto-navigation — the app never automatically follows URLs, preventing drive-by attacks
• Local data storage — free users' scans stay on your device; Premium adds automatic backup to your own iCloud or Google Drive, which you can turn off. Nothing is sent to our servers

Compare this to your phone's built-in camera, which shows a brief URL preview but will navigate immediately if you tap the notification — and keeps no history of what you've scanned.

What to Do If You Scan a Malicious QR Code

1. Don't enter any information — close the page immediately if it's asking for credentials or payment
2. Don't tap "Install" — if a page prompts you to install an app, decline
3. Check your accounts — if you did enter information, change passwords and enable 2FA immediately
4. Report it — physical fake QR codes should be reported to the business or local authorities; email quishing attempts should be reported to your IT team or the Anti-Phishing Working Group (APWG)
5. Run a security scan — if your device accessed a suspicious URL, run a mobile security scan

Summary: Safe QR Scanning Practices

• Always preview the URL before opening it
• Be skeptical of QR codes in unexpected places or messages
• Check physical QR codes for signs of tampering
• Use a scanner app that shows the destination before navigating
• Never scan a QR code that a stranger asked you to scan
• Keep your scan history so you can audit what you've accessed