QR Code Scams (Quishing): How to Spot Them and Scan Safely
Fake parking-meter stickers, "scan to receive money" UPI tricks and phishing emails with QR codes are on the rise. Here is how quishing works and how to stay safe.
By MakeMyQROnline team Published 4 min read
Key takeaway
Quishing is phishing through a QR code: the code sends you to a fake website or payment request instead of a link you can inspect. Stay safe by checking the web address your camera shows before opening it, never entering a UPI PIN to receive money, looking for stickers placed over real codes, and logging in only through official apps.
What is quishing?
Quishing (QR + phishing) is when scammers use a QR code to send you somewhere harmful. It works because a QR code hides its destination: you see a pattern of squares, not a web address, so a fake login or payment page can look like the real thing.
QR codes themselves are not dangerous — a QR code is just text, usually a link. The risk is the page or payment it opens, exactly like a link in an email or SMS.
Common QR code scams to know
| Scam | How it works | Red flag |
|---|---|---|
| Fake parking or EV-charging codes | A sticker is placed over the real code on a meter or charger and leads to a look-alike payment site. | A sticker on top of the sign, or a web address that isn't the city's or operator's. |
| "Scan to receive money" (UPI) | A "buyer" sends a QR code and says scanning it will pay you. Scanning and entering your PIN actually sends money from you. | Any request to enter your UPI PIN to receive money. |
| Phishing emails with a QR code | An email "from IT, your bank or a delivery company" asks you to scan to re-verify an account, avoiding the link filters that scan emails. | Urgency ("account locked in 24 hours") and a login page on an unfamiliar domain. |
| Fake delivery or fine notices | A card or letter says a parcel is held or a fine is due and you must pay via the QR code. | Small "release" fees and payment by link instead of the official website. |
| Swapped restaurant or shop codes | A fake payment code is stuck over the shop's real UPI code. | The payee name on your UPI app doesn't match the shop. |
9 ways to scan QR codes safely
- Read the preview. Your camera shows the link before opening it. Check the domain is the one you expect — watch for misspellings and extra words.
- Never enter your UPI PIN to receive money. In UPI, the PIN is only ever needed to pay or check your balance.
- Check the payee name in your UPI app before you confirm any payment.
- Look for stickers. On parking meters, chargers, posters and counters, feel for a label stuck over the original code.
- Log in through the official app or website you already use — not through a page a QR code opened.
- Be suspicious of urgency in emails, letters and messages that ask you to scan.
- Don't install apps from a QR code outside the Play Store or App Store.
- Keep your phone and browser updated so known malicious sites are blocked.
- If in doubt, type the address yourself instead of scanning.
Making QR codes for your business? Make them trustworthy
- Print the code with your logo and a clear label ("Pay Sharma Store", "Menu", "Guest Wi-Fi") — see adding a logo.
- Use a link on your own domain where you can, so customers recognise it in the preview.
- Check your printed codes regularly for tampering, especially outdoors.
- For payments, put your shop name next to the UPI QR code so customers can match it with the payee name.
How MakeMyQROnline protects people who scan
Static codes made here contain exactly what you typed — nothing is added. For dynamic codes, destinations are checked to block known phishing patterns, and anyone can report a suspicious QR code; codes found to be abusive are suspended.
What to do if you were scammed
- Contact your bank or UPI app immediately and ask them to block the transaction or your card.
- Change passwords for any account you entered on the fake page, and turn on two-step verification.
- In India, call the national cyber-crime helpline 1930 or report at cybercrime.gov.in. Elsewhere, report to your national fraud or consumer-protection agency.
Make yours now — free, no signup
Live preview, your colours and logo, PNG / SVG / PDF download.
Frequently asked questions
Can scanning a QR code hack my phone?
Scanning alone just reads text, usually a link. The danger is what you do next — opening a fake site, entering passwords or a UPI PIN, or installing an app. Check the link preview before you open it.
Do I need to scan a QR code to receive money on UPI?
No. You never need to scan a code or enter your UPI PIN to receive money. Anyone asking you to do that is trying to take money from you.
How can I check where a QR code goes before opening it?
Point your camera at it and read the link it shows before tapping. Phone cameras and Google Lens display the destination first.
Are QR codes from a QR code generator safe?
A static QR code contains only what its creator typed, so it's as safe as that link. What matters is who made the code and where it leads.
- QR code scam
- quishing
- QR code phishing
- UPI QR code fraud
- scan QR code safely
