Short answer
Quishing is phishing delivered through a QR code. Scammers place fake codes, often stickers over genuine ones on parking meters, tables and posters, or send them in emails, to lead people to cloned payment or login pages.
Why QR codes are attractive to scammers
A normal phishing link can be read before you click it. A QR code cannot be read by a human at all. The destination only appears for a moment in the camera preview, and on a small screen most people tap without reading. Quishing grew sharply in 2026, with one industry tracker reporting a 146% jump in the first quarter alone.
The common forms
- Sticker overlays. A printed sticker is placed over the genuine code on a parking meter, EV charger, restaurant table or poster. The FBI and numerous US cities have warned about fake parking payment codes.
- Email quishing. A QR code in an email ("scan to re-verify your account") bypasses email link scanners and moves the victim to a phone, where security tools are weaker.
- Fake delivery and fine notices. Printed cards claiming a missed parcel or unpaid fine with a code to "pay now".
- Payment QR swaps. At market stalls and small shops, a scammer's payment QR is placed over the merchant's, so payments go to the wrong account.
How to protect yourself
- Look at the sticker. Is it a separate label stuck on top? Are the edges raised or misaligned?
- Read the address before opening. Your camera shows the domain. Is it the organisation you expect, spelled correctly?
- Be wary of short links that hide the destination. Check them with a QR safety checker.
- Never enter card details after scanning a code from an email or text. Go to the organisation's app or type its address yourself.
- When paying for parking, use the official app or type the website printed on the signage.
How businesses can protect customers
- Use codes that show a recognisable verification step with your business name.
- Print the domain customers should land on next to the code.
- Monitor your codes. A code that is covered stops getting scans. Kizmo tamper alerts watch for exactly that.
- Inspect codes in public areas regularly, and use tamper-evident frames or laminates.
Frequently asked
Can scanning a QR code hack my phone?
Scanning alone does not install anything on a modern phone. The danger comes from what you do on the page it opens, such as entering a password or card number, or installing an app.
How do I report a fake QR code?
Tell the business or council that owns the location. If it is a Kizmo code, use the report link on its verify page and the owner is alerted immediately.