Skip to main content

What to do now

QR code phishing (quishing): what to do

Last checked

A QR code hides its link until you scan it. Fake codes are stuck over real ones on parking meters and charging stations, or printed in letters and emails that look official. Treat the link behind a code like any other link.

Already paid or signed in? Start with step 4.

Do this now

  1. Look at the code itself

    On a parking meter, a charging station or a poster, check that the code is not a sticker placed over the original.

  2. Read the link before you open it

    Many QR readers show the address first. Check that it is the real domain, with no misspelling or switched letter; at the slightest doubt, don’t open it.

  3. To pay, open the official app or site yourself

    Type the operator’s address or open its app rather than paying through a scanned link. A code in an email or a letter you weren’t expecting, especially one that urges you to act fast, is not worth scanning.

  4. Typed a password or card details? Act now

    Change the password on the real site, call your bank if you entered card details, and check your statements for payments you did not make.

  5. Report the page

    Report the address the code led to with the services below.
On this page07

Check it with isMalicious

isMalicious compares what you paste with the threat intelligence sources it collects. It does not scan your device and cannot undo what already happened.

URL scanner

If your QR reader shows the link without opening it, copy it and paste it into the URL scanner.

What it does not mean
Not listed is not proof of safety: a fake code can lead to a page created the same day.
  • Malicious URL database: the malicious and phishing URLs with enough threat intelligence for a report, shown as text, never as clickable links.

Report it

Keep the message, the link or the number until you have reported it: you will need them. These are the services that handle each case.

In the United States

In the United Kingdom

Wherever you are

Somewhere else? Report to your national police or your country’s cybercrime reporting service.

In France? The French version of this guide lists the French services.

How to spot the next one

  • A sticker over the original code, or a code where there was none before.
  • A letter, a flyer or an email with a QR code about a fine, a parcel or an account to confirm, asking you to act fast.
  • A code that leads to a sign-in page, for example to confirm your Microsoft 365 or email account.
  • The address the reader shows does not match the operator named on the sign.

Questions

Can scanning a QR code put my phone at risk?

A malicious code can take you to a fake page or try to install malware. Read the link before you open it, and keep your phone’s software up to date.

I paid for parking through a scanned code. What now?

Check your bank statements, and call your bank if you see a payment you did not make or if you typed your card details into a page you now doubt.

How do I check a QR code without opening it?

If your reader shows the link first, copy it and paste it into the URL scanner, or read the domain carefully. Don’t open it to find out.

Related guides

Sources

The steps follow these official pages, read on :

Free account

Keep checking with a free account

Without an account, checks stop at 10 an hour. With a free account you skip that wait and can run up to 60 a minute, and you can save up to 10 reports every 30 days.

Create free account

No credit card required