QR code scams (quishing): how to spot them

“Quishing”, short for QR phishing, means getting you to scan a QR code that leads to a fake website, to steal logins or card details. The code itself is nothing special: the page it opens is the trap.

Unsure about a QR code? Upload a photo of it: our tool shows where it leads, without your phone opening the page.

Check a QR code

Risky situations

A sticker placed over the original code on a parking meter, an EV charger or a poster.
An “urgent” letter or email (fine, parcel, taxes) asking you to scan a code to pay.
A code in a public place asking you to log in or enter a card number.

Warning signs

The address shown does not match the expected organisation: typos, odd name, unusual extension.
The page immediately asks for a payment, a password or a code received by text message.
An urgent tone: “final reminder”, “within 24 hours”.

Good habits

Read the address offered by the camera before opening it.
To pay a fine, parking or taxes, use the official website you type yourself, not a code you received.
When in doubt, upload a photo of the code to our tool: it shows where it leads without opening it on your phone.

If you already entered information

Card details: call your bank to block the card right away.
Password: change it everywhere you used it.
Report the fake website to your national cybercrime or anti-phishing service.

Questions

Can a QR code install a virus?

The code only holds text. The danger is the website it opens or a file downloaded afterwards: never download anything unexpected.

What does QR Durable do about abuse?

Any code can be reported through the Contact page; a code leading to a fraudulent site is switched off.