What Is Quishing? How to Spot a QR Code Scam

QR codes have become part of everyday life. We use them to pay for parking, view restaurant menus, access promotions, and manage accounts. But as QR codes grow in popularity, scammers have found new ways to abuse them.

Quishing is a form of phishing that uses QR codes instead of traditional links. Instead of clicking a suspicious email link, a person scans a QR code that leads to a fake website designed to steal personal or financial information. Because QR codes hide their destination until after you scan them, these scams can be harder to recognize at first glance.

How Quishing Scams Work

Quishing scams follow a simple but effective pattern:

• Criminals create fake QR codes that look legitimate.
• Those codes are placed on signs, stickers, emails, mailers, or posters.
• Scanning the code takes you to a fake website, payment page, or login screen.

Many of these scams appear in everyday places, which lowers natural suspicion. Some QR codes are even designed with colors, logos, or images to look more official and trustworthy.

Common QR Code Scam Scenarios

Quishing scams tend to show up where people already expect to see QR codes.

• Parking meters or parking payment signs
• Restaurant table cards or menus
• Utility bills or invoices
• Public posters, flyers, or event signage
• Messages claiming there is an account issue or a delivery problem.
• Fake QR codes are also commonly used to promote fraudulent deals or payment pages, like the scams customers encounter while shopping online.

In some cases, scammers place a sticker with a fake QR code directly over a real one, making it almost impossible to notice the difference.

How to Spot a Fake QR Code

Knowing what to watch for before and after scanning can help you avoid quishing scams.

Signs the QR Code Itself May Be Suspicious

• A sticker placed on top of another QR code.
• Poor print quality or blurry images
• Branding or colors that do not match the business or organization.
• QR codes posted in unusual or unexpected locations.

Red Flags After You Scan

• Requests for login credentials or payment information
• Urgent language that pressures you to act quickly
• Web addresses that look misspelled or unfamiliar
• Pages that do not use secure HTTPS connections.
• Scammers may try to capture login details via fake QR code pages, which increases the risk of password overload and account compromise.

Situations That Require Extra Caution

• QR codes that ask for payments, refunds, or banking information.
• Unsolicited QR codes received through text messages, email, or mail.
• Claims that an account is locked, compromised, or time sensitive.

If something feels off, trust that instinct and stop immediately.

Are QR Codes Always Dangerous?

No. QR codes are widely used for legitimate purposes, and many businesses rely on them every day. The risk comes from familiarity. When people scan QR codes without pausing to verify the source, scammers gain an opportunity.

Awareness is the goal, not avoidance. Being cautious and informed about mobile device safety helps you use QR codes safely without fear.

What to Do If You Think You Scanned a Fake QR Code

If you believe you scanned a suspicious QR code:

• Stop entering information right away.
• Close the webpage or app.
• Monitor your bank and credit card accounts for unusual activity.
• Update passwords if login details are entered.
• Contact your bank promptly if financial information is shared.

Acting quickly can help limit potential damage.

How Heritage Bank Helps Protect You from Fraud

As phishing and fraud become more prevalent, protecting your financial information is one of Heritage Bank’s top priorities. We actively monitor unusual activities, provide alerts when something looks out of place, and offer ongoing education to help customers stay informed about evolving scams. If you ever have questions or concerns about a QR code, transaction, or account activity, our team is here to help. When in doubt, reach out directly.