QR code scam (quishing): parking, parcels, banks
A QR code in an email, a letter or on a parking meter asks you to pay or confirm an account? It may be quishing. How to spot it and what to do.
A QR code in an email, on a letter, on a parking meter or on a parcel: handy, right? Scammers think so too. They hide their trap link inside a QR code. This is called quishing (see the definition).
Why it works
Your email app can spot a dangerous link written in plain text. It is much worse at reading an image. And when you scan the code with your phone, you leave the protections of your computer. The address is hidden: you don't see it before the page opens.
The most common versions
- Parking: a sticker with a QR code is put on a meter or a pay station. It leads to a fake payment site that collects your card details.
- Parcels: "your package is on hold, scan to reschedule delivery". Same trick as the parcel delivery fee scam.
- Banks and well-known services: "scan to verify your account", with a copied logo. The code opens a fake login page.
- Paper letters: a fake letter from an agency with a QR code "to pay now".
Signs to watch for
- The message is unexpected and pushes you to act fast.
- The QR code is the only way to act: no reference number, no other explanation.
- It is stuck over another sticker, or the sign looks homemade.
- The address your phone shows isn't the organisation's, or has typos or extra words.
- You are asked for your card, a password or a code sent by text.
What to do
- Don't scan a QR code from an email you didn't expect.
- To pay or check something, type the official address yourself or use the official app.
- After a scan, read the address before the page opens. If in doubt, close it.
- If you entered your card, call your bank to block it. If you typed a password, change it everywhere you use it.
- Report it to your local police or consumer protection agency, and tell the parking operator if a meter was tampered with.
Check it with Fishi
Forward the email to check@fishi.email, ideally as an attachment. Fishi reads QR codes in the email's images, checks where they lead and whether they are on phishing lists, then replies: safe, suspicious or scam, and what to do. It's free and needs no account.