Are QR codes safe? Quishing, and how to not get caught

The honest answer: a QR code cannot hurt you. What it points to can.

The pattern is just text. It has no code, no executable, no way to touch your phone. But it is also completely opaque to a human eye — and that is precisely what makes it a good delivery mechanism for a scam.

Why scammers like QR codes

A phishing link in an email can be inspected. You hover, you read the domain, you notice it says paypa1 instead of paypal.

A QR code gives you none of that. It is a square of noise. You have to scan it to learn anything, and by then you are already on the page.

Add the fact that a sticker costs almost nothing and can be placed anywhere, and you have a low-effort attack with a high success rate. Security people call it quishing.

The scams that actually happen

Parking meters. A sticker over the real code sends drivers to a fake payment page. They enter card details to pay for parking that was never in question.

Fake restaurant menus. A code on a table tent leads to a page that asks you to "log in with Google to see the menu". It never shows a menu.

Invoice and bill scams. A letter or email with a QR code for payment. The code carries a payment request to the scammer's account, formatted to look official.

Package delivery notices. A card on your door: "we missed you, scan to reschedule". The page asks for a small redelivery fee, and your card number.

Crypto donation swaps. A published wallet QR replaced with the attacker's address. Irreversible by design.

Fake WiFi. A code that joins a network the attacker controls, so they can watch unencrypted traffic.

Notice the pattern: none of these attack your phone. All of them attack your trust in a physical location.

The one habit that stops almost all of it

Read the destination before you tap.

Every modern phone camera shows the URL as a preview before opening it. Most people swipe past that preview without reading. Do not.

When you read it, check three things:

1. The domain, character by character. amazon-secure.co is not Amazon. rnicrosoft.com uses rn to look like m.
2. Whether the domain matches the context. A parking meter in São Paulo linking to a domain in another country is a red flag.
3. Whether it is a shortener you cannot see through. bit.ly/xY3 tells you nothing. For a code in a public place, that alone is reason to stop.

If you want the full text rather than a truncated preview, our QR reader decodes and shows it without opening anything.

The physical check nobody does

Look at the code itself. Most real-world quishing is a sticker placed over a legitimate code.

Run a finger over it. If you feel an edge, or see a corner lifting, or the code sits slightly crooked while everything else on the sign is straight — it was added. On parking meters and public terminals this is by far the most common attack, and it takes two seconds to spot.

Where to be strictest

Never scan a code to make a payment unless you are certain of the source. Read the decoded content: for PIX you should see the payee name; for crypto, verify the address against one you already trust.

Never enter a password on a page you reached by scanning a code from a public place. Open the app or type the address yourself.

Be sceptical of urgency. "Scan to avoid a fine", "scan within 24 hours" — pressure is the oldest trick, and it works because it stops people from reading the URL.

For anyone publishing QR codes

If you print codes for customers, you carry some of this responsibility:

• Print the destination in text beside the code. "Scan or visit yoursite.com/menu". It costs nothing and lets people verify.
• Use your own domain, not a shortener. A recognisable domain is a trust signal a scammer cannot copy easily.
• Laminate or emboss codes in public places, so a sticker over the top is visible.
• Check your codes periodically if they are somewhere the public can reach.

That last one is skipped almost universally. If you have codes on tables or windows, look at them once a month.

What about the generator itself?

Worth asking, since you are on one. Two risks exist with any QR tool:

The tool sees your data. If you encode a WiFi password, a PIX key or a wallet address, whoever runs the generator can read it — unless the generation happens in your browser. On QRWisp it does: open your browser network tab while generating and no request carries your input.

The tool controls the redirect. A dynamic code from a free tool means that company decides where your printed code leads, today and in future. Our codes are static — your content goes straight into the pattern, and there is no server in the middle.

In short

• QR codes cannot infect your phone. Destinations can deceive you.
• Read the URL before tapping. Check the domain letter by letter.
• Feel for a sticker over the original, especially on public terminals.
• Never pay or log in from a code you found in a public place.
• If you publish codes, print the address in text next to them.

The habit takes two seconds and defeats nearly every version of this attack.

If you are reading this because something already happened: contact your bank immediately if card details were entered, and change the password on any account you logged into. Speed matters more than certainty.