A QR code is just a link in picture form. You can't see where it leads until you scan — and scammers know it. The newest wave of attacks doesn't hack your phone. It just sticks a fake sticker over a real code and waits for you to do the rest. This free check shows you how the scam works and tests whether your habits would stop it.
What is quishing?
Quishing is phishing via QR code — scammers stick fake codes over real ones so your phone opens their malicious site instead. The QR code scam works because people trust printed codes more than links, and a sticker costs the attacker almost nothing.
How the restaurant demo works
On Oct 16, 2026, a widely shared demo by Rossen, staged with security expert Jim Stickley, showed the attack in real life: a "hacker" slides a fake menu onto a restaurant table. Its QR code looks identical to the real ones. A diner scans it and lands on a pixel-perfect copy of the restaurant's site, offering 10% off — but unlocking the "deal" requires creating an account. The moment the victim types an email and password, the attacker harvests the credentials in real time from outside the restaurant.
The scariest part: nothing about the code itself looks wrong. The danger is the page it opens — and what that page asks you to type.
The other common variants
Self-test: This page ends with a 5-question quishing check to test whether you would spot the scam before typing your details.
Parking-meter sticker swaps. In September 2026 the FTC warned that scammers are pasting their own QR stickers over legitimate codes on parking meters, routing drivers to fake payment sites that steal card numbers and personal data. Variants have hit EV charging stations and donation boxes too.
Package-delivery QRs. A text or email claims a parcel couldn't be delivered and asks you to scan a code to reschedule — the code leads to a phishing page.
Account-problem messages. A message claims something is wrong with your account and asks you to "confirm" your details by scanning.
Fake app downloads. A code leads to a harmful or fake app. The FBI advises never downloading an app from a QR code — use your app store instead.
Crypto and payment swaps. A QR that should open a payment or wallet address is replaced with the attacker's own, diverting funds.
⚠ The key insight
Scanning a code almost never hurts you by itself. The damage happens when you type — a password, a card number, a code — into the page that opens. Treat every QR landing page the way you'd treat a random link in a spam email.
Red flags — spot the fake before you type
The sticker test. A code that looks pasted over another code, crooked, freshly added, or glossy on a dull printed sign is suspect. Run a thumbnail across the edge — if it peels, don't scan.
Unexpected delivery. A QR code in a text, email, or flyer you didn't ask for — especially one pushing urgency — is a classic phish.
Read the preview. Most phone cameras show the web address before opening it. Misspelled brand names, extra words, or a domain unrelated to the business = stop.
Instant login or payment demand. A scan that immediately asks for a password, card details, or account creation is the hallmark of the scam.
"Too good" bait. A discount, prize, or freebie that requires signing up first is designed to make you hand over credentials willingly.
Install-to-continue. Any code that requires installing an app before you can pay or proceed is a red flag.
What to do instead
Preview first, always. Check the URL your camera shows before tapping it — it must match the business you expect.
Skip the code. Type the official address yourself or open the business's official app instead of following a QR link.
Inspect physical codes. Look for stickers, tampering, or a second competing code on the same sign or meter.
Use your phone's built-in scanner. The FBI advises against downloading separate QR scanner apps, which can be malicious themselves.
Verify through a known channel. If a code seems to come from a company or friend, confirm via a phone number or website you already know.
FROM INGENIOUS AI
One scanned code is all it takes to hand over your credentials. Our free checkers cover the rest of your digital life: scams, breaches, passwords, and AI risks.
Answer honestly. This tests your scanning habits, not any one code.
QR Scam FAQ
Can a QR code infect my phone just by scanning it?
Rarely. The code itself is just a link in picture form — the website it opens is the danger. The damage happens when you type a password, card number, or personal detail into the fake page, or download a malicious app it pushes.
How can I tell if a physical QR code is fake?
Look for a sticker pasted over another code, crooked or freshly applied printing, or two competing codes on the same sign. Run a thumbnail across the edge — if it peels, it's a sticker someone put there.
What should I do if I already typed my details into a fake page?
Change any password you provided immediately, check your bank and card statements for unfamiliar transactions, and report the fake code to the property owner or city plus the FTC at reportfraud.ftc.gov.
Are QR codes in texts and emails always scams?
No — but an unexpected code pushing urgency is a classic phish. Verify with the supposed sender through a phone number or website you already know before scanning.
Should I use a QR scanner app?
No. The FBI advises against downloading separate QR scanner apps — most phones already scan codes with the built-in camera, and third-party scanner apps can themselves be malicious.
Honest scope
This page summarizes public warnings and reporting; it is not a substitute for the FTC's or FBI's official guidance.
The restaurant scenario is a staged demonstration of a real attack pattern — physical QR-swap theft is documented by the FTC (Sept 2026) and local police reports.
Vendor-quoted statistics (e.g. industry surveys on scan rates) are reported figures from named sources, not independent findings.
Trigger: Rossen reel, "The New QR Code SCAM — Don't Scan This!", Oct 16, 2026, demo with Jim Stickley (summarized, not quoted).