How Cyber Criminals Are Hijacking QR Codes—and How to Stay Safe
In an increasingly contactless world, QR codes have become a familiar part of everyday life. Whether you’re ordering at a restaurant, paying for parking, or logging into an online account, QR codes offer convenience and speed. But cyber criminals have taken notice too. A new report by Action Fraud has revealed a worrying trend: over the past year (April 2024 to April 2025), 784 incidents of ‘quishing’ were reported, resulting in nearly £3.5 million in losses.
Quishing is a form of phishing that uses QR codes to trick victims into revealing personal and financial information. These codes, once scanned, can redirect users to fraudulent websites, prompt harmful downloads, or impersonate legitimate services like HMRC or parking companies.
This blog explores how quishing attacks work, the environments where you’re most at risk, and most importantly, what steps you can take to stay safe.
What is Quishing?
Quishing, short for QR phishing, involves the use of malicious QR codes to exploit unsuspecting users. Unlike traditional phishing, which usually involves deceptive links in emails or texts, quishing leverages the fact that QR codes are visual and often unverified by the human eye.
These fraudulent codes are typically disguised as legitimate ones. Cyber criminals may place a sticker with a fake QR code over an authentic one, often in high-footfall locations such as car parks, transport stations, or even restaurants. Once scanned, these QR codes may direct users to spoofed websites that request sensitive information like login credentials, banking details, or payment authorisations.
Recent examples have shown criminals targeting online sellers with fake QR code requests, impersonating government agencies like HMRC, and tampering with physical machines in public car parks to siphon money through bogus payment portals.
Where Quishing Happens The Most
Action Fraud’s report highlights several common environments where quishing is on the rise:
- Car Parks: Fraudsters frequently place stickers over QR codes on payment machines. These codes redirect drivers to fake payment sites that capture card details.
- Online Marketplaces: Sellers receive fake QR codes via email, asking them to scan the code to receive payment or verify an account. These lead to malicious login pages.
- Government Impersonation: Emails claiming to be from HMRC or similar government entities include QR codes that direct victims to phishing sites, often disguised as refund portals or tax verifications.
- Public Spaces: Bus stops, train stations, and even restaurant menus have become unexpected hotspots for quishing.
Protect Yourself: Best Practices to Avoid Quishing
Be vigilant with public QR codes
QR codes in open, unmonitored spaces such as car parks, train stations, EV charging points, and bus shelters are especially vulnerable to tampering. Fraudsters typically print out fake QR codes and stick them over the legitimate ones. These altered codes often redirect you to spoofed payment portals or malware-infected websites that harvest your details. If a QR code looks misaligned, off-centre, or like a sticker placed on top of something else, be suspicious. Instead of scanning, navigate directly to the official website or use a verified app to complete your transaction.
Pause and verify URL details before proceeding
Most smartphone cameras and QR scanners will show a preview of the URL before loading the website. Always examine the URL carefully—look for small spelling mistakes, strange domain names, or shortened links (e.g., bit.ly or tinyurl) which could be hiding malicious destinations. Even if the page looks like a trusted site, it could be a very convincing clone. Secure websites should always begin with “https://” and display a padlock icon.
Treat QR codes in emails and texts with extreme caution
A rising number of quishing attacks are launched through social engineering—where an attacker sends an email or SMS containing a QR code designed to look like it’s from a trusted source. If you weren’t expecting the message, don’t scan it. Go to the company’s website directly and log in through the secure portal. This rule is especially crucial for businesses, where internal staff can be tricked into scanning rogue codes appearing to come from HR, IT, or finance departments.
Use your phone’s built-in QR scanner, not a third-party app
Many third-party QR scanning apps offer little to no security controls—and some are actively malicious. Stick to your phone’s built-in QR code scanner, usually accessed via the default camera app. These built-in systems are regularly updated and are less likely to open harmful URLs without warning. If your phone doesn’t support QR scanning natively, download a trusted app from a reputable developer with high reviews.
Monitor financial activity closely—especially after scanning to pay
Many victims of quishing only realise they’ve been scammed days or weeks later. After using a QR code to make a payment, keep a close eye on your bank statements and credit card activity. Set up real-time transaction notifications if your bank offers them. If you spot any suspicious transactions, report them immediately. Acting quickly can make the difference between a minor issue and a devastating loss.
Educate your team and social circle about quishing threats
Cybersecurity is only as strong as the least-informed person in your network. Share this blog and other resources with friends, family, and especially elderly relatives or those less tech-savvy. In the workplace, conduct short security briefings to highlight the dangers of QR-based attacks. Include quishing in phishing simulation exercises.
Report suspicious incidents—don’t stay silent
The only way for authorities and cybersecurity teams to stay ahead of quishing tactics is through accurate, timely reporting. If you receive a suspicious email or text with a QR code, forward it to the UK’s official reporting service at phishing@report.gov.uk. If you’ve scanned a code and think you may have entered personal or financial information, report it to Action Fraud or by calling 0300 123 2040.
Final Thoughts on Quishing
Quishing may be a modern twist on an old scam, but it’s growing rapidly. As our lives become more integrated with digital transactions and contactless experiences, we must stay alert to emerging threats like malicious QR codes.
Organisations like Action Fraud are sounding the alarm now, but it’s up to individuals and businesses to take proactive cybersecurity measures. By understanding the risks and adopting secure behaviours, you can protect yourself and your data from becoming another statistic.
For more information or to learn how Data Transfer Security can help safeguard your organisation against quishing and other cyber threats, get in touch with our team today.
