A QR code scam — or quishing — refers to a fraudulent activity where attackers replace or create QR codes that direct unsuspecting users to harmful websites or services. Once scanned, these codes may prompt users to input personal information, financial details, or even install malware onto devices. The critical issue stems from the fact that QR codes do not reveal their target destination until after scanning, making them an ideal vehicle for fraudsters.

Quishing is different to traditional phishing emails because it exploits how people interact with scannable codes. Convenience often outweighs caution, but this trust can be easily manipulated. To stay safe, it’s important to treat QR codes like links — always pause and check before scanning.

In the UK, QR codes are now used everywhere — from parking payments to restaurant menus and access control. Their widespread use has made them a fertile ground for fraudsters. UK reports show that quishing incidents increased significantly from 2024 to 2025, with hundreds of cases reported and millions lost to fraudulent schemes.

The rise of mobile working and reliance on smartphones for daily tasks means that many people scan QR codes without thinking twice, especially when in a hurry, making it easier for criminals to exploit this behaviour.

Quishing campaigns often start with emails that appear legitimate but contain malicious QR codes. These codes might mimic trusted brands or services and request that employees verify accounts or confirm details. Once scanned, the victims are redirected to fake login pages that capture credentials.

For businesses, this can lead to compromised accounts, financial losses, or network breaches. Because QR code scams can slip past standard email filters, businesses must adopt layered security and employee awareness to mitigate risk.

Not all QR codes are dangerous — many are perfectly safe and legitimate. However, you should always question where a QR code came from before scanning. Legitimate QR codes are usually found on official materials from known companies or organisations.

If a QR code appears in an unexpected email, on a random public sign, or in a location that doesn’t make sense (such as a parking machine with no official indication), it’s wiser to avoid scanning it. Always double‑check the URL that loads after scanning.

Yes. One of the main goals of quishing is to capture login credentials. Attackers can design malicious sites that ask for usernames and passwords just like genuine services do. Once a person enters this information, hackers can use it to access accounts and sensitive data.

This is why combining practices like employee training, secure email filtering, and multi‑factor authentication (MFA) is critical in reducing the impact of successful credential theft.

If you suspect you’ve scanned a malicious QR code, stop interacting with the resulting website immediately. Do not enter any personal or financial information. If you did enter data, change passwords right away and contact your IT support or bank for further advice.

Reporting the incident can help local law enforcement track scammers; in the UK, you can report fraud to Action Fraud. It’s also wise to run a malware check on your device and monitor your accounts for unusual activity.

Start by educating staff about the risks of QR codes and how to think critically before scanning. Treat QR codes with the same level of caution as email links. Implement security solutions that scan and flag suspicious emails or codes, and enforce multi‑factor authentication to reduce the damage from stolen credentials.

Additionally, review physical QR codes your business uses regularly and remove or replace any that have been tampered with or look unfamiliar.

Some mobile devices and QR scanner apps allow you to preview the destination URL before opening it in a browser, which is an essential safety feature. A less technical step is to research where the QR code should take you using a trustworthy source, such as the official website or app.

Security platforms can also help identify and block malicious codes before they reach users. These tools supplement strong internal policies and employee awareness to help reduce the risk of falling for QR code scams.