Scan With Caution: How QR Code Phishing Works and How to Spot It

Quick Response codes sit on restaurant tables, parking meters, payment kiosks, and paper mailings across the country. They offer an effortless bridge between the physical world and a smartphone screen, yet that exact convenience creates an opening for fraud. Security officials call this tactic quishing, short for QR code phishing, where criminals use misleading visual codes to redirect unsuspecting people to deceptive websites.

What quishing is

Quishing represents a shift in classic phishing tactics. In traditional phishing, criminals send deceptive emails or text messages that contain clickable links. Security tools and trained consumers have learned to examine those web addresses closely before opening them. A QR code, however, acts as a visual mask. It is a graphic barcode that stores data, most often a web address, that human eyes cannot decipher on sight.

According to the United States Postal Inspection Service, quishing relies heavily on the everyday trust people place in a quick scan. Because phone cameras instantly process the code and prompt the browser to load the destination, users can find themselves landing on an unverified site before realizing where they were sent. The Federal Trade Commission has warned consumers about how scammers hide harmful links inside QR codes to steal personal information, highlighting the need for caution whenever a code appears outside a verified context.

How the scam usually works

The mechanics of a quishing attack depend on misdirection and speed. Scammers frequently place physical stickers containing fraudulent QR codes in busy public spaces, such as transit hubs, parking kiosks, or outdoor advertisement boards. They may paste their illicit code directly over an authentic business code. In other instances, fraudsters transmit the codes electronically through unsolicited emails or text messages, often creating a false sense of urgency to scan immediately.

Once a target scans the code, the smartphone browser loads a spoofed website designed to mimic a legitimate organization. Criminals frequently impersonate trusted institutions, such as a state or federal government agency, a commercial bank, a shipping service, or a utility provider. Because the fake website closely mirrors real branding, visitors are coaxed into submitting sensitive credentials.

Through these deceptive forms, bad actors attempt to gather critical personally identifiable information, including:

• Account usernames, email addresses, and passwords
• Social Security numbers and complete dates of birth
• Credit card and debit card account numbers
• Personal identification numbers (PINs) and security verification codes

Once gathered, this data can be exploited immediately to compromise financial accounts, or it may be traded across illicit networks to facilitate broader identity theft.

The brushing variation

A distinct variation of this scheme combines physical delivery fraud with digital quishing, often referred to as a brushing scam. In this scenario, a resident receives an unexpected package on their doorstep containing an inexpensive item, such as an unbranded electronic accessory, a trinket, or small piece of jewelry, that they never ordered.

Tucked inside the package is a printed card featuring a prominent QR code. The instructions on the card typically instruct the recipient to scan the code to find out who sent the gift, claim a supposed warranty, or register the product for customer support. Scanning the code routes the recipient to an unauthorized portal set up to harvest account details and payment data. Receiving unrequested merchandise in the mail is a clear signal to slow down, and scanning any accompanying card can expose your device and accounts to unnecessary risk.

Red flags and questions to ask

Recognizing the warning signs of a quishing attempt can help consumers avoid compromise before entering sensitive data. While the visual nature of the barcode obscures the underlying web address, the context surrounding the code usually provides telling indicators. Being alert to your surroundings and inspecting printed materials can prevent major issues.

Key warning signs include:

• Physical stickers placed over pre-existing signs, especially at parking meters, payment counters, or public transit stations
• Unsolicited text messages or emails containing a QR code accompanied by language demanding urgent payment, account verification, or package redelivery
• A scan that routes your phone to a strange, unfamiliar, or misspelled web address that does not match the official organization domain
• Unsolicited packages delivered to your home that include instructions to scan an enclosed code

Before pulling out your phone camera, pause and ask two direct questions: where did this QR code come from, and who posted or sent it? If the sender is unknown, or if the code appears on a physical sticker that looks tampered with, avoid scanning it. When dealing with an account or agency notification, type the known web address directly into your browser or use an official mobile application instead of following an unverified code.

For incidents involving suspected mail delivery or postal schemes, the U.S. Postal Inspection Service requests that individuals forward details and suspicious messages directly to [email protected].

Known gaps in the available guidance

While public advisories establish the core dangers of quishing, existing official summaries leave several questions unaddressed. Public excerpts from postal inspection advisories cut off before providing an exhaustive checklist of protective protocols, and consumer alerts do not outline complete verification techniques for evaluating a link safely before interacting with it. Furthermore, public data sets currently available do not publish specific figures tracking total financial losses or exact victim counts tied exclusively to QR code phishing.

Official agency notices also do not detail comprehensive recovery steps for someone who has already scanned a malicious code and submitted private details. If you suspect you entered sensitive financial credentials or login information on a fraudulent page, rapid independent action remains essential. Contact your bank or credit card company immediately using the phone number printed on the back of your physical card to freeze affected accounts. You can also place an alert on your credit files by reaching out to the major consumer reporting bureaus, and submit a report through official channels such as the FTC or the Consumer Financial Protection Bureau to document unauthorized identity activity.