Cybersecurity agencies and researchers are warning that scams involving QR codes are becoming more common. In these “quishing” (QR code phishing) attacks, criminals use QR codes that direct people to malicious websites or impersonation pages. The outcome can include unauthorized payments, theft of personal information, or device compromise, security experts say.
On January 28, 2026, reports cited a warning issued earlier this month by the U.S. Federal Bureau of Investigation (FBI) about campaigns that used fraudulent QR codes to trick users into sharing personal information. Security analysts say similar tactics are appearing in multiple countries as attackers look for new ways to reach victims.
Quishing generally works by persuading a person to scan a QR code that leads to a counterfeit website designed to resemble a legitimate service—such as a payment portal or business page. Authorities in several regions have reported cases where criminals placed QR-code stickers over real QR codes in public locations, including kiosks, restaurants, and parking meters.
In the United Kingdom, public agencies have previously warned about fake QR-code stickers on parking machines that redirected users to fraudulent payment pages. In the United States, the Federal Trade Commission has also warned about QR codes included with unexpected deliveries that led to phishing sites.
Attackers also distribute malicious QR codes digitally. In some cases, QR codes have been embedded in emails and presented as a method to obtain additional information or access a document, prompting recipients to scan rather than click a link.
Planet VPN, a VPN provider, said the tactics are broadly consistent regardless of where the QR code is placed: the code redirects to a spoofed website, and the victim may be prompted to enter login details, download a file, or submit payment information. The company’s co-founder, Konstantin Levinzon, said QR codes can lower a user’s suspicion because they shift the “risky click” from a visible URL to a scan that hides the destination until after it is opened.
Levinzon also said QR codes may be used in emails because some security filters focus on text and links and may not fully analyze QR codes embedded in images. He added that attackers sometimes modify QR-code designs—such as using different colors—to avoid detection.
Security researchers at Proofpoint have estimated that millions of QR code-related threats were observed during the first half of last year, while other analysts note that totals may be undercounted because many incidents go unreported or undetected.
To reduce risk, security professionals recommend scanning QR codes only when the source is clear and the context makes sense. If scanning a code leads to a site requesting payment details, login credentials, or a file download—especially when unexpected—experts advise treating it as a warning sign.
When QR codes arrive via email or message from an unfamiliar sender, experts recommend verifying the request through a separate channel before entering credentials or downloading anything. More broadly, standard safeguards—keeping devices updated, using strong passwords and multi-factor authentication, and taking precautions on public Wi-Fi—remain part of basic defensive hygiene.
