The QR Code That Isn’t What It Seems
What this means
A sticker over a real QR code can send you to a lookalike site. Quishing is quiet, physical, and easy to miss when you’re in a hurry to pay or park.
Note: This site may show light ads and occasional affiliate links. How that works.
QR codes feel like shortcuts: park, pay, join Wi‑Fi, open a menu. That convenience is why attackers stick fake codes over real ones, or print fresh ones on posters that look official.
The scam name you’ll hear is quishing — phishing via QR. The destination is usually a familiar-looking login or payment page.
Remember this: Before you type a password after a scan, read the URL as carefully as you would an email link.
1. Where it shows up
Parking meters, restaurant tables, parcel lockers, office “scan for Wi‑Fi” posters, and charity collection points. Anywhere a scan replaces a typed address, a sticker can redirect you.
On a busy pavement you may not notice the code sits slightly proud of the surface — a second layer over the real one.
2. A two-minute vignette
You’re late for a meeting. The meter’s QR looks fine. The phone opens a payment site with the council’s colours. You enter card details. Later, a second charge appears — and the real parking fine still arrives because the first payment never reached the council.
The code didn’t “hack” the phone. It simply sent trust to the wrong place.
3. Practical checks
- Preview the link before opening (most phone cameras show the URL).
- Look for stickers or codes that sit oddly on top of signs.
- Prefer official apps or typed addresses for parking, banking, and workplace logins when you can.
- Don’t enter passwords on a site you reached only via a random public QR.
- If money is involved, a minute spent finding the real site beats hours of card disputes.
A habit to keep
Scan for convenience; type for trust when money or logins are involved.
QR codes are tools. The habit is treating the destination like any other link — because that’s all it is.