How to spot a malicious QR code before you scan it
QR codes are everywhere now: restaurant menus, parking meters, tickets, utility bills, emails from your HR department. That is exactly what criminals are exploiting. Security firm ESET recorded a sharp rise in quishing — QR-code phishing — through the first half of 2026, with the technique appearing in roughly one in ten phishing emails the company analysed, at a pace of around 100,000 detections per month. The FBI issued its own warning about QR-code lures used in targeted attacks in January 2026.
The attack is simple. A scammer takes a QR code that points to a fake login page or payment form and puts it where a real one would be: a sticker over the real code on a parking meter, an attachment in an email that looks like a payroll notice, a flyer promising a refund. You scan it, your phone opens the link, and everything afterwards looks ordinary — right up until you type your password or card number into a page that belongs to somebody else.
Why QR codes slip past your defences
On a computer, you can hover over a link and read where it goes before clicking. A QR code removes that check entirely: the destination is encoded inside an image, your phone opens it directly, and the small screen makes it easy to miss or dismiss the address bar. Add the physical-world familiarity of QR codes — we scan them without thinking at tables and ticket machines — and you get a tool that bypasses both suspicion and security software.
Email filters have the same problem. A normal phishing link can be compared against a blocklist of known bad domains. A QR code inside an image or a PDF has to be detected, decoded and then checked — a step many systems still skip.
The 10-second check, every time
- Look at where it is. A printed sticker pasted over a code on a parking machine, a bike-share dock or a toll notice is the classic physical scam. If a code looks added-on, misaligned or sits on a different material than its surroundings, do not scan it.
- Read the preview before you tap. Nearly every phone camera shows the destination link for a moment before opening it. Make it a habit to read that domain, character by character. paypa1.com and paypal.com are different places.
- Treat urgency as a signal. "Pay within 24 hours or lose your parcel." "Your benefits will be suspended." Urgency exists to stop you thinking. Real organisations do not need you to skip verification.
- Never log in or pay from a scan you did not ask for. If an email says to scan a code to review a payroll document, open the company's website yourself — type the address you already know — and check from there.
- Be extra careful with codes that ask for money or credentials. A QR code on a museum wall that opens a Wikipedia page costs you nothing if it is fake. One that opens a payment page or a sign-in form can cost you everything.
What to do if you already scanned a bad code
If you entered a password on a suspicious page, change that password immediately — from a device and site you trust — and anywhere else you reused it. If you entered card details, call your bank. Turn on multi-factor authentication for the affected account so a stolen password alone is not enough. Then, if the code came from an email, report it to your IT department or the impersonated company; and if it was a physical sticker, alert the owner of the machine.
Making QR codes people can trust
The flip side matters too. If you put a QR code on a poster, an invoice or a product label, your customers are running the same risk calculus in reverse. Two things help: point the code at a domain they recognise, and prefer codes that encode a plain, readable URL over ones that bounce through redirects or shortened links. If you need to make one, the QR code generator on this site encodes exactly what you type — URL, text, Wi-Fi details or a contact card — and shows you the content as it will be decoded. It runs entirely in your browser, so nothing about your Wi-Fi password or customer data is sent anywhere.
Frequently asked questions
Can a QR code install malware on my phone?
Scanning itself does not install anything — the danger is what the code opens. A malicious page can trick you into installing an app or entering credentials, and some attacks chain a scan into a download. The safe habit is the same either way: read the destination before opening it, and never install anything a QR code asked you for.
My phone shows a link preview. What exactly should I look for?
The domain, not the words around it. Check the part just before the first single slash: secure.microsoft.com.verify-login.ru is a Russian domain, not Microsoft. Shortened links (bit.ly and similar) hide even that — treat them as unverified.
Are QR codes on parking meters and menus safe?
Usually, but these are precisely the places scammers overwrite. A sticker placed over the original code is nearly invisible if you are not looking for it. If a parking code leads to a payment page you have never seen before, compare the domain with the one you used last time, or pay at the machine's own screen instead.
Do I need special software to check a QR code safely?
No. Most modern phones show a link preview in the camera app itself, and that preview is all you need for the domain check described above. If you want a second opinion on a code you already have, take a photo of it and inspect it on a computer with any reputable QR decoder — and pick one that processes the image in your browser rather than uploading it.