QR code scams (quishing): how they work and how to stay safe

A QR code is just a link in a different shape. You cannot read it with your eyes, which is exactly why scammers use it. Phishing through QR codes is called quishing.

Where fake QR codes show up

• Stickers placed over real codes on parking meters and charging stations
• Fake restaurant menu or payment codes
• Emails and letters that say you must “scan to verify” an account
• Flyers and posters in public places

Safe scanning habits

1. Look at the preview. Most scanners show the web address before opening it. Read it.
2. Check for tampering. If a QR sticker is on top of another, or looks peeled or misaligned, do not use it.
3. Be wary of urgency. “Scan now to avoid a fine” is a pressure tactic.
4. Do not enter logins or card numbers on a page you reached by QR code unless you are sure of the domain.
5. Type the address yourself for anything involving money or accounts.

Scan it with LinkGuard first

LinkGuard reads the QR code, follows any redirects and checks the destination against threat databases before you open it. If the verdict is risky, you will know why.