How to Spot a Fake QR Code Before It Steals Your Password

QR codes feel safe. That is exactly the problem.

A link in a suspicious email at least gives you something to read. A QR code gives you nothing — a block of pixels you are expected to trust on sight. That is why QR code phishing, known as quishing, is one of the fastest-growing scam categories in 2026. Security filters struggle to scan images the way they scan text, so attackers embed malicious QR codes directly in emails, on stickers pasted over legitimate codes, and anywhere a camera is quicker than common sense.

The authorities have noticed. The FBI issued a 2026 advisory on QR-code spearphishing tactics targeting U.S. organizations, and the FTC has warned about criminals covering parking-meter and payment QR codes with their own stickers. When the QR code on a parking meter might have been pasted there by someone who is not the city, 'scan first, think later' is a habit that needs to die.

The 30-second check before you scan

You do not need security software to beat most quishing. You need thirty seconds of suspicion:

• Preview the URL before tapping. Most camera apps show the link before opening it. Read the domain from right to left — the real domain is the chunk just before the first single slash. paypal.com.evil-login.xyz is not PayPal.
• Never enter credentials from a scanned page. If a QR code lands you on a login screen, close it and open the site yourself by typing the address. Two minutes of annoyance beats an account takeover.
• Inspect physical codes. Sticker overlays on parking meters, restaurant tables, and chargers are a classic. If the code looks pasted on top of another code, or the surface looks tampered with, do not scan it.
• Treat unsolicited QR emails as guilty until proven innocent. A QR code in an email from your 'IT department' asking you to 're-authenticate' is the 2026 version of the fake password-reset link. Verify through a separate channel.

The cloned-brand login page is the real payload here. Scammers do not want your scan — they want the login you type into the page the scan opens. That is why the credential rule matters more than the scanning rule.

The parking meter rule

Make this the mental model: any QR code in a public place is untrusted by default. Parking meters, EV chargers, restaurant menus, charity flyers, package 'redelivery' slips — all of them can be covered with a malicious sticker in seconds, for zero cost to the attacker. If the sticker looks slightly off — wrong size, covering part of another code, different paper — walk to the actual payment terminal or ask staff.

Payment QR codes deserve special care. Unlike a link you can inspect later, a payment QR sends money now. Double-check the recipient name shown on screen before confirming anything.

When you already scanned something sketchy

Do not panic, but do not shrug either. If you typed credentials into a page that now looks wrong: change that password immediately, and change it anywhere else you reused it — which is exactly why passkeys are worth the switch. Enable two-factor authentication on the account if you have not. Check the account for unfamiliar sessions, devices, or forwarding rules. If money moved, contact your bank now, not tomorrow.

Then report it. In the U.S., that means the FTC and the FBI's IC3; other countries have equivalent cybercrime portals. Reporting does not get your data back, but these reports are how investigators map scam campaigns — your ten minutes helps the next person.

QR codes are not going away, and most of them are harmless. But the safest scan is a suspicious one. If you want a broader sense of how exposed your details already are, run through the data-leak check — knowing what is already out there makes every future scam easier to spot.