QR Code / Quishing

Are those QR code scams real? Yes, and here's the tell

By Grandma Pearl · Updated June 2026 · 3-minute read

Short answer, sugar: Yes, they are real, and they have a silly name: "quishing." It is just an old trick, phishing, hiding inside one of those little square codes. The good news is the same calm habit beats it. Let me show you.

You have seen those checkerboard squares everywhere now, dear. You point your phone at one and it whisks you off to a website. Handy. But here is the rub: a QR code is just a link in disguise, and your eyes cannot read where it goes. Scammers love anything you cannot read at a glance.

So they get to work. They print a fake code on a sticker and slap it right over the real one on a parking meter or a public charger. Or they mail you an official-looking notice ("scan to confirm your delivery" or "scan to pay your toll") with their code inside. You scan, you land on a page dressed up like the real thing, and you type in your card. Now those crooks have it.

The tell: a QR code you did not go looking for is the warning sign, especially in an unexpected text, email, or piece of mail, or one that looks like a sticker stuck on top of something. The code hides the destination, and that is exactly why a scammer reaches for it.

Pearl's one rule for those little squares

Do not scan a QR code you did not expect, and never enter your card or password on a page a code sent you to. If you need to pay a meter or check a bill, use the official app or type the real website yourself.

If you do scan one, your phone will show the web address before it opens. Read it first. If it is a jumble, or not the company you expected, close it. And on anything in public, give the code a quick look and a little scratch, a fraud sticker often peels at the corner.

Where these show up most

What if I already scanned and entered something?

Don't fret, honey, you can still get ahead of it. If you typed your card, call your bank using the number on the back of the card and watch for charges. If you typed a password, change it right away and turn on two-step verification. If a download started, delete it. Then report it at reportfraud.ftc.gov. Quick action keeps a scare from becoming a loss.

🏮 One new scam, every week, in plain English

Join The Porch Light and I'll send you the free Family Safe-Word Kit today.

More from the porch: Is the "USPS package fee" text a scam? "You have an unpaid toll", is that text a scam?

Sources: Federal Trade Commission, consumer alert on QR code scams (consumer.ftc.gov); FBI Internet Crime Complaint Center (ic3.gov). Grandma Pearl is an AI character (always labeled). Educational content only, not financial or legal advice.