There's a scam running in parking lots across the United States, the UK, Germany, and Australia right now. It works like this: someone prints a fake QR code sticker, walks up to a legitimate parking meter or pay station, and covers the real payment QR code with theirs. Drivers scan it, enter their card details on a convincing fake payment page, and drive away thinking they've paid. They haven't — but someone else now has their card number.

This isn't a hypothetical. It's been documented at scale in cities including Austin, San Antonio, Houston, and London. It's one of dozens of QR-based attack patterns that have matured from proof-of-concept into operational fraud campaigns over the past two years. And it works because QR codes have a fundamental usability design: they're opaque. You cannot look at a QR code and know where it goes. You have to trust the physical context around it — which is exactly what attackers exploit.

This guide is for two audiences: everyday users who want to scan QR codes without being exploited, and businesses creating and deploying QR codes who have responsibilities toward their users' data and trust. Both have more to think about than most people realise.

Why QR Code Security Matters More Than Ever in 2026

QR code scanning crossed into mainstream behaviour during the pandemic years, when contactless menus and check-ins normalised the gesture of pointing a phone at a code in a public space. By 2026, that habit is deeply embedded across a vast range of physical environments: restaurant tables, parking meters, hospital check-in signs, retail store windows, event venues, product packaging, transport ticketing, and direct mail campaigns.

The FBI issued a public advisory on QR code fraud as early as 2022, warning that cybercriminals were increasingly embedding malicious URLs in QR codes placed at public locations. That advisory wasn't a warning about an emerging threat — it was documenting an already-operational attack category. Since then, the attack surface has grown considerably as QR code density in public spaces has increased and dynamic QR code platforms have made redirectable codes accessible to anyone with a browser.

What makes QR codes particularly challenging from a security standpoint is the combination of three factors: they're physically anchored in trusted environments (your bank branch, your favourite restaurant, your city's parking infrastructure), they're technically opaque to visual inspection, and the user action — pointing a camera and tapping a notification — takes a fraction of a second and requires almost no conscious engagement. That combination is an attacker's dream.

How QR Code Scams Actually Work

QR code attacks aren't a single technique — they're a category of social engineering that exploits the visual opacity of QR codes and the trusted physical contexts in which they're typically found. Understanding the attack mechanics is the first step toward effective defence.

Physical Overlay Attacks

The simplest and most common physical attack: a malicious QR code sticker is placed directly on top of a legitimate one. Payment terminals, parking meters, bike share stations, restaurant table cards, and public notice boards are all common targets. The attacker prints a convincing sticker — often with branding that matches the surrounding context — and places it over the real code. Every person who scans it goes to the attacker's destination instead of the legitimate one.

These attacks are particularly effective because the surrounding context — a real parking meter, a real restaurant table — creates strong implicit trust. The victim has no reason to question the code; everything around it looks legitimate. The attack typically doesn't even require the attacker to be present during exploitation — they set it and leave, collecting credentials or payments remotely.

Malicious QR Codes in Email and Digital Channels

Email-based QR attacks — formally called "quishing" — have grown substantially since 2023 for one specific reason: they bypass many email security filters. Traditional phishing links in emails are caught by URL scanning tools that check the link against known malicious domains. A QR code in an email is an image — most email security tools in 2024 couldn't extract and analyse the URL encoded inside it, making QR codes a reliable way to smuggle phishing links past corporate email defences.

The attacker embeds a QR code image in a legitimately-looking email — a package delivery notice, a banking security alert, a DocuSign request, an HR policy update — and instructs the recipient to scan the code for action. Because many employees scan with personal phones that aren't monitored by corporate security tools, the attack often bypasses both email filtering and endpoint protection simultaneously.

Fake Free Wi-Fi QR Codes

Attackers place QR codes in public spaces — coffee shops, hotels, airports, conference venues — advertising free Wi-Fi. When scanned, the code connects the phone to a rogue access point controlled by the attacker. Once the user is on that network, their unencrypted traffic can be monitored and intercepted — login credentials for sites without proper HTTPS enforcement, cookie sessions, and form data all become visible.

Quishing — The QR Phishing Attack Explained

Quishing deserves its own dedicated attention because it represents a genuinely novel evolution in phishing technique, not just a variation on an old attack. The term combines "QR code" and "phishing," and while it describes any phishing attack delivered via QR code, the email vector is where it's had the most documented impact on organisations.

Why Quishing Defeats Standard Email Security

Standard enterprise email security works by scanning links in emails against threat intelligence databases of known malicious URLs, and by following redirects to check where a link ultimately leads. This has been effective against traditional phishing links for years. Quishing sidesteps this by replacing the clickable link with a QR code image. Most email security tools — particularly older generation secure email gateways — treat the QR code as an image attachment, not as an embedded URL, and don't attempt to decode and evaluate the URL contained within it.

Newer AI-powered email security solutions (Microsoft Defender, Proofpoint, Mimecast, among others) have added QR code detection capabilities since 2023, and this is an arms race that continues. But in 2026, a significant proportion of organisations — particularly smaller businesses and those with legacy email infrastructure — still have no specific detection capability for quishing attacks.

The Anatomy of a Quishing Campaign

A well-constructed quishing attack typically follows this structure: the attacker sends an email that mimics a trusted sender — a bank, a logistics company, an internal IT department, or a cloud service the recipient uses. The email creates urgency: your account needs verification, your package is being held, your password has expired. It instructs the recipient to scan a QR code to resolve the issue. The code leads to a credential-harvesting page that closely resembles the legitimate service. The victim enters their credentials. The attacker captures them in real time.

The additional effectiveness of the QR code delivery mechanism is that it moves the click to a personal mobile device. Corporate laptop users are often protected by managed device policies, endpoint detection tools, and network monitoring that flags unusual browsing. Personal phones used to scan the QR code are typically outside all of these controls — the scan, the page visit, and the credential entry happen on an unmonitored device over an unmonitored network connection.

Real-World QR Scam Case Studies (2025–2026)

Dynamic QR Codes and the Redirect Risk

Dynamic QR codes — those that route through a redirect server rather than encoding the final URL directly — introduce a security consideration that static codes don't have. The redirect layer is what makes dynamic codes updatable and trackable, and those features are genuinely valuable for legitimate business use. But they also create a specific risk profile that both creators and scanners should understand.

The Platform Compromise Scenario

When you create a dynamic QR code through any platform, the printed code's behaviour depends entirely on that platform remaining secure and under your control. If an attacker compromises your account on the QR code platform — through credential theft, a weak password, or a phishing attack against you — they can update the redirect to point anywhere they choose. Your printed materials, your packaging, your table codes, all start silently routing scanners to an attacker-controlled destination without any visible change to the code itself.

This isn't a theoretical risk unique to disreputable platforms — it's an inherent characteristic of the dynamic redirect architecture that applies to any service. Protecting your QR code dashboard account with a strong, unique password and two-factor authentication isn't optional if you're deploying codes at scale.

Platform Trust and Data Custody

Every scan of a dynamic QR code passes through the platform's servers before reaching the final destination. That means the platform knows about every scan: when it happened, from where (approximate geographic location), on what type of device, and potentially the referring source. You're trusting the platform with this aggregated scan data about your users. Understanding what a platform does with that data — whether it sells it, shares it with third parties, uses it to build advertising profiles — is a question worth asking before deploying dynamic codes at scale.

What Scan Analytics Actually Collect About You

From the scanner's perspective — the person who scanned a dynamic QR code on a menu, a poster, or a business card — the experience looks and feels identical to scanning a static code. No prompt, no warning, no indication that data about the scan is being collected. But behind the millisecond redirect, a data collection event has occurred.

Here's what a typical dynamic QR code platform collects at the moment of scan:

This data — individually and in aggregate — constitutes personal data under GDPR. IP addresses are explicitly classified as personal data under European law, even when approximate location is all that's derived from them. Timestamp plus IP plus device type, combined across multiple scans, can form a pattern that's potentially identifiable to an individual user. This has significant compliance implications for any organisation in the EU or serving EU residents.

GDPR, CCPA, and QR Scan Tracking Compliance

This is the area where many small businesses deploying dynamic QR codes are unknowingly non-compliant, often without realising that compliance obligations apply to them at all. If you're an EU-based business, or a business that serves EU residents in any capacity, and you're deploying dynamic QR codes that collect scan analytics, you have active obligations under GDPR.

What GDPR Requires for QR Scan Analytics

GDPR requires that data subjects (the people whose data is being collected — in this context, the people scanning your QR codes) be informed about data collection and have a lawful basis established for it. For scan analytics collected through a dynamic QR code, the relevant obligations typically include:

Transparency: The people scanning your QR codes should be informed that scanning constitutes a data collection event. This doesn't mean a popup every time someone scans — it means the data collection should be disclosed in your organisation's privacy policy, and ideally signposted near deployed codes in contexts where users have a reasonable expectation of privacy.

Lawful basis: You need a legitimate legal basis for processing the scan data. For most business analytics use cases, "legitimate interests" is the most applicable basis — but it requires a documented balancing test showing that your interest in the analytics data doesn't override the reasonable privacy expectations of the scanner. Simply assuming it's fine isn't sufficient documentation.

Data minimisation: You should only collect what's necessary for your stated purpose. If you're using scan analytics purely to know how many times a menu QR was scanned, you may not need granular IP-level location data per scan. Check what your QR platform actually collects and whether it's configurable.

Processor agreements: The QR code platform that processes scan data on your behalf is a data processor under GDPR. You should have a Data Processing Agreement (DPA) in place with them. Major platforms typically make these available — but smaller or newer platforms may not, which is a compliance gap worth addressing before deployment.

CCPA Considerations for US-Based Deployments

California's CCPA (and its amended version, CPRA) grants California residents the right to know what personal information is collected about them, the right to opt out of its sale, and the right to request deletion. Scan analytics that include IP addresses constitute personal information under CCPA. If you're a business that meets CCPA's applicability thresholds and deploys QR codes in California or to California residents, the same disclosure and rights obligations apply.

How to Spot a Malicious QR Code Before You Scan

The fundamental challenge is that QR codes are visually opaque — two legitimate codes and two malicious ones look identical to the naked eye. Defending against QR attacks isn't primarily about visual inspection of the code itself; it's about inspecting the context around it and developing habits for what happens immediately after scanning before you interact with anything on the destination page.

Pre-Scan Checks

Check for physical tampering. Before scanning any QR code at a payment terminal, parking meter, or public location, check whether the code shows signs of being a sticker placed on top of the original. Look at the edges — a sticker overlay often has slightly raised edges, bubbling, misalignment with surrounding graphics, or different paper texture to what's around it. Take an extra second at parking meters and payment points in particular.

Is the code in an expected location? A QR code on the wall of a public bathroom, on a bench in a park, or in an unexpected location where no obvious legitimate purpose exists should be treated with significant scepticism. Attackers place codes in public spaces precisely because they inherit ambient trust from their surroundings.

Look at the surrounding branding carefully. Does the QR code's visual design and accompanying text match the branding of the organisation it claims to represent? Mismatched fonts, slightly off logos, generic language, and missing corporate identifiers are all potential indicators of a counterfeit code.

Post-Scan Checks (Before You Do Anything)

Modern smartphones display a preview of the URL encoded in a QR code before opening it in a browser — a notification banner appears with the URL visible. Before tapping to open, read the URL. Check that it starts with HTTPS (not HTTP). Check that the domain name is the legitimate organisation's actual domain — attackers use variations like parkm0bile.com or paypal-security.net that look right at a glance. If anything about the URL looks off, don't proceed.

If you've already opened a page from a QR code, apply the same scepticism you'd apply to any unsolicited website: does it match the legitimate site's visual design exactly? Is the URL still correct once the page loads? Does it ask for credentials or card details with unusual urgency? Is there any pressure to act immediately? Any of these are grounds to close the tab and verify through a different channel.

Secure QR Code Deployment for Businesses

For businesses creating and deploying QR codes — whether for menus, payments, marketing, or operational purposes — security and privacy aren't just concerns for the IT department. They directly affect customer trust, legal compliance, and the integrity of your operations. Here's what responsible deployment looks like in 2026.

Technical Standards

Physical Deployment Security

For any QR code deployed in a physical public space — particularly payment contexts — tamper evidence is an important physical security measure. Holographic overlays, transparent tamper-evident seals placed over printed QR codes, and regular physical inspection of deployed codes are all practical measures that raise the cost and visibility of physical overlay attacks.

For high-traffic or high-value deployments (large-venue events, busy retail environments, public payment points), periodic visual inspection schedules make sense. Train any on-site staff to recognise the signs of QR overlay attacks and to report or remove suspicious additions immediately.

The Sensitive Data Rule for Static Codes

Static QR codes are permanently encoded images. Once generated, the data inside them is permanent and cannot be revoked. Never encode sensitive, secret, or authentication-critical data in a static QR code — this includes passwords, API keys, access tokens, private links to sensitive documents, or any information that would cause harm if the printed code were photographed by someone other than the intended recipient. Static codes are suitable for public-facing information (website URLs, public contact details, Wi-Fi credentials for guest networks) where the information being freely accessible doesn't create risk.