Because a QR code is unreadable to the human eye, attackers can swap a legitimate code for a malicious one on parking meters, restaurant table tents or shipping labels. This is called quishing — QR phishing — and it's rising fast. Here's how to defend both your users and your brand.
How quishing works
Attackers print stickers of malicious QR codes and place them over legitimate ones in public places. Victims scan, land on a lookalike login page, and enter credentials or card details. Because it happens on a phone, the usual anti-phishing signals (URL bar length, browser warnings) are easier to miss.
Protect the people who scan your codes
Print your QRs directly onto the surface where possible (menu covers, packaging) rather than as removable stickers. On stickers, add a tamper-evident finish and check them daily.
Always show the destination URL next to the QR ("Scan or visit example.com/menu"). If someone replaces the QR, the URL beside it will still be right, and a careful user will notice the mismatch.
Protect your brand
Never send QR codes in email that ask users to log in — this is the most common quishing pattern. Train staff and customers to type your domain manually for anything involving credentials or payment.
Safe scanning advice you can share with users
Preview the URL before opening it — both iOS Camera and Android show the URL first. Look for the expected domain and reject anything that redirects through unfamiliar shorteners. Never enter passwords or payment details on a page reached only via a QR you didn't verify.
Key takeaways
- Print QR codes directly onto surfaces; audit any stickers daily.
- Always show the destination URL in plain text next to the QR.
- Never use QR codes in email for login — attackers rely on that pattern.
About the author
QRPixel Team — QR code specialists
The QRPixel editorial team writes practical, tested guides on QR codes for businesses, marketers and creators. Every article is reviewed against real scanning conditions and current QR standards.
Related articles
Create your own QR code
Free, private and unlimited. No signup, no watermarks.