Quishing: how to spot a malicious QR code before scanning

The code you see isn’t necessarily the one that was placed

“Quishing” — QR code phishing — is the modern adaptation of classic phishing: instead of a link in an email, the attacker plants a code. It’s a redoubtable vector because a QR code is unreadable to the naked eye: there’s no way to “hover over the link” as you would on a computer. The phone becomes the only window — and most people open without looking.

This isn’t a theoretical threat. The FBI published an official warning in January 2022 about cybercriminals “tampering with QR codes to steal victim funds,” and the FTC devoted a December 2023 consumer alert to malicious links hidden in QR codes — citing, among other things, fake codes stuck on parking meters. France’s cybersecurity agency ANSSI similarly advises treating QR codes with the same suspicion as unsolicited links.

Why QR codes are such an effective phishing vector

Three properties make the QR code a better delivery vehicle than a link for an attacker. First, opacity: a URL shows its destination in text; a pattern shows nothing — victims can’t apply the “check the link” reflex they learned for emails. Second, the context switch: codes are scanned on phones, where URLs display truncated on small screens and where users have fewer security indicators than on a desktop browser. Third, speed: the physical world punishes hesitation — someone standing at a parking meter, in a hurry, phone in hand, is precisely the victim profile fraudsters design for. Understanding this explains why every defense below comes down to one move: restoring the visibility the pattern took away.

The physical warning signs

• A sticker pasted over another code: the fraudulent code is literally placed on top of the legitimate one — on a parking meter, a rental ad, a restaurant menu. If the code is a sticker with edges sticking out or peeling, be suspicious.
• A code where none should be: a QR stuck on a pole, a table, a bus shelter, with no context and no operator mentioned, comes with zero guarantee of origin.
• A payment or urgency context: “pay for your parking,” “settle your delivery,” “your package is held.” QR-code scams almost always target either payment or credential theft — both thrive on manufactured urgency.

The signs in the decoded content

This is where the technical habit changes everything: decode without opening. A scanner that shows the raw content before any action gives you what the eye cannot:

• A shortened URL (bit.ly, tinyurl, generic domains) hides the real destination — legitimate parking or menu operators use their own domain.
• A lookalike domain: paystation-parking.com is not paystation.com. Fraudsters bet on quick reading on a small screen.
• http:// instead of https://: a legitimate payment site in 2026 doesn’t run unencrypted. FlashScan Pro explicitly flags unencrypted links before opening.
• Content that isn’t a URL: a “parking” code that decodes to a phone number, a pre-filled SMS, or plain text deserves the same scrutiny.

The reflexes that cut the attack

1. Scan with a tool that shows the content — FlashScan Pro’s scanner displays the decoded payload and opens nothing without your action. That’s the difference between “scanning” and “opening.”
2. Read the entire domain, not the start of the URL. The domain is everything before the first / — the rest is decoration.
3. For payments, use the official channel: type the parking operator’s address yourself or use its app, rather than the decoded link.
4. Never enter credentials on a page reached through an unknown QR code: that is phishing’s exact entry point.
5. Distrust urgency: a message that presses (“fine doubles in 24 hours”) is a signal, not information.

Quishing doesn’t only live on walls

Posters and parking meters make the headlines, but the most profitable channel for fraudsters remains the message: an email or SMS saying “package pending,” “unpaid invoice,” “secure your account” carrying a QR code instead of a classic link. The code bypasses filters that analyze URLs in the text — which is precisely why the FTC flags the technique in its alert. On this channel the signals change: no sticker to inspect, but a sender to verify, a manufactured emergency, and the same remedy — decode the code with a tool that shows the destination before opening it.

What if the code is legitimate?

Most QR codes are harmless — the goal isn’t paranoia but hygiene. Sorting takes five seconds once you know where to look: coherent context, no suspicious sticker, official domain over https. Quishing exploits the reflex “scan = open”; breaking it into two steps — “scan, read, then open” — neutralizes the vast majority of traps.

Going further

The same caution applies to codes sent to you: scanning a QR code from an image lets you decode a screenshot received in a chat before deciding what to do with it. And if you’re curious about what does — or doesn’t — travel the network, scanning without uploads explains how to verify decoding stays local.