Quishing: QR code scams and how to check a code before you scan

Someone walks along a row of parking meters with a sheet of pre-printed stickers and covers the payment QR code on each one. It takes about four seconds per meter, the sticker costs a penny, and the drivers who scan it are handing card details to a page that looks exactly like the council’s.

Three ways the attack is delivered

Physical overlay. A sticker over a legitimate code on a parking meter, an EV charger, a restaurant table, a parcel locker, a bike-share dock, a poster in a station. The context does the persuading: you already intended to pay for parking, so a payment page is not suspicious.

Email and documents. A QR code pasted into a phishing email, an invoice PDF or a fake MFA-enrolment notice. This exists specifically to defeat controls, because a QR code is an image, and link scanners in mail gateways do not follow URLs they cannot read as text. It also pivots the victim from a managed laptop to a personal phone, outside whatever filtering the organisation runs.

WiFi and other payload types. A QR code can encode WiFi credentials in a WIFI: payload, and a phone will offer to join that network. Joining an attacker’s access point puts them between you and everything you do next, usually behind a captive portal that asks you to “sign in” with a real account. The same applies to tel: and SMSTO: payloads that pre-fill a premium-rate number, and vCard payloads that write a plausible-looking contact into your address book for later.

A QR code cannot itself contain malware

Worth stating plainly, because the fear is usually misdirected. The largest possible QR code holds 2,953 bytes, and readers treat the contents as text. There is no execution step, no attachment, no drive-by. A scan on its own does nothing but display a string.

Everything harmful happens afterwards, and requires you: tapping the link, typing a password, entering a card number, approving a payment, installing an app or a configuration profile. That is good news, because it means the entire defence is a few seconds of reading before you tap.

Read the URL before you tap

Every modern phone shows the decoded URL before opening it — iOS as a notification banner, Android in the Lens or camera overlay. That preview is the whole security control, and most people dismiss it without reading.

What to look for, in order:

Find the registrable domain. That is the part somebody actually had to buy: the public suffix — .com, .ru, .co.uk, .gov.uk — plus the single label in front of it. In https://secure-payments.parking.example.ru/council/pay it is example.ru; in https://pay.yourcouncil.gov.uk/parking it is yourcouncil.gov.uk. Everything to the left of that is subdomain text the attacker chose freely, and everything after the first single slash is a path they also chose. Padding the left-hand side with reassuring words is the oldest trick here and it still works.

Distrust shorteners. bit.ly, tinyurl.com, t.co and vendor QR shorteners all hide the destination completely, and you cannot evaluate what you cannot see. A legitimate business printing a public code has no good reason to use one, which is part of the argument in static versus dynamic QR codes.

Watch for lookalike domains. paypa1.com, rnicrosoft.com, example-support.com, example.com.co. Read it character by character rather than recognising the shape.

Treat xn-- as a stop sign. A domain starting xn-- is punycode — a Unicode name encoded for DNS. It has legitimate uses, but it is also how homoglyph attacks work: a well-known 2017 demonstration registered a name written entirely in Cyrillic letters that displayed as apple.com in the address bar while the real registered domain was xn--80ak6aa92e.com. If a preview shows a familiar brand name but the URL contains xn--, it is not that brand.

Other tells. An @ anywhere before the first slash (everything before it is ignored by the browser). Plain http:// on anything asking for money. An immediate file download. A prompt to install an app or a configuration profile. A page that asks you to log in when you were only trying to see a menu.

Physical tells on a printed code

• A sticker over a sticker — check for a raised edge, a lifted corner, a slight colour or gloss mismatch, a square that sits proudly above a laminate.
• Print quality that does not match the sign it is on: a crisp inkjet code on a weathered screen-printed board.
• A code with no surrounding branding, or branding that does not match the venue.
• A code taped or stapled on, where everything else is printed in place.

Peel a suspect sticker. If there is another code underneath, that is your answer and it is worth telling the business.

If you already tapped

Work down this list and stop when it stops applying.

1. You opened the page and typed nothing. Nothing has happened. Close it.
2. You entered a password. Change it from a different device, on a URL you typed yourself. Enable two-factor authentication. Then check the account for mail forwarding rules, connected or authorised apps, recovery addresses and unfamiliar sessions — attackers set up persistence before they do anything visible.
3. You entered card details. Call the bank, freeze the card, and watch for a small test transaction rather than a large obvious one.
4. You installed an app or a configuration profile. Remove it, and on iOS check Settings for VPN and Device Management profiles you did not add.
5. You joined a WiFi network from a code. Tell the phone to forget it, and change any password you entered while connected.
6. It was a work account. Report it. The same campaign is almost certainly in other inboxes.

What businesses should do

The customer cannot solve this on their own; the placement has to help.

• Make tampering hard. Put the code under a laminate, behind glass, etched into the fascia or printed directly onto the surface rather than applied as a label. Anything a sticker can be pressed onto flat is easy to cover.
• Print the domain in readable text beside the code. A line saying pay.yourcouncil.gov.uk gives customers something to check the preview against, and it is the single cheapest control available.
• Own the destination domain, and keep it short and legible. A code that resolves to your own name is verifiable; a code that resolves to a shortener trains your customers to accept exactly what the attacker will send them.
• Never use a code to request payment where a person could have been replaced — invoice-payment QR codes are a well-worn fraud vector, and suppliers changing bank details by email or QR should always be verified by phone on a number you already had.
• Audit placements. If codes are in the field, someone should look at them on a schedule. A sticker can sit on a charger for weeks.
• Design the code to be readable in the first place. A code that fails and makes people hunt for an alternative is a code that trains them to scan whatever else is nearby — one more reason to work through why your QR code is not scanning before printing.

About this site

Codes made with the generator are encoded in your browser and contain your URL literally, with no shortener and no redirect, so there is no third party between a scanner and your destination. The /qr/ image API renders on request without writing the URL anywhere, and both it and the share pages send X-Robots-Tag: noindex, nofollow, so nothing you generate turns up in a search result. The full detail of what is and is not stored is in the FAQ.