QR codes have become the standard: parking via cell phone, digital menus, parcel notifications, posters with “More information” – a quick scan and you’re in. It is precisely this routine that makes quishing (fraud through manipulated QR codes) so attractive. A QR code is nothing magical, it’s just a packaged internet address. In contrast to a visible link, you can hardly see where the journey is going before scanning.

And because the code appears “printed”, for many people it automatically feels more official than a link in an email. Criminals take advantage of this – in places where people have little time in everyday life: at parking machines, in the crowd at the train station or when they quickly look at their cell phone.

How fraudsters exploit QR codes in everyday life

Codes pasted over are particularly common on parking ticket machines or charging stations:
The sticker looks officialbut leads to a fake version of the actual payment page. False notes on the car or in the mailbox are also popular: alleged traffic tickets, package notifications or “account security” letters that request a scan.

And even in restaurants, manipulated QR menus can lure unsuspecting guests to sites that later ask for data or payments – for example via mandatory registrations, competitions or alleged WiFi portals in order to access the on-site network.

Parking machine, restaurant, mailbox: The most common quishing traps

The simplest variant is a sticker: a real QR code is stuck over. The scan then does not lead to the city, the operator or the well-known app, but to a deceptively real copy. There you should enter payment details or log in. A plausible story is often told: “Payment failed, please try again” – while in reality the personal data has long since been accessed.

Some sites even redirect to the real provider site so that the fraud goes unnoticed. In other cases, an app installation is triggered (“Please update parking app”) or permissions are requested that are completely unnecessary for the purpose. Because many security filters primarily check text links in emails, a QR code often slips through more easily.

Why quishing on smartphones is particularly successful

The trap is particularly effective on a smartphone: the screen is small, the address is displayed in abbreviated form, and a professional design looks familiar. There is also social pressure: the parking ticket is running, the line is behind you, the restaurant is waiting. Anyone who then enters their card or login data will not only lose money.

Four simple rules: How to recognize dangerous QR codes immediately

If a QR code is stuck in a public space, it’s worth taking a quick look:

1. Does the code act like a sticker on top of another? Then don’t scan.
2. If possible, use the direct method for payments: open the official app or type in the known web address yourself.
3. View the destination address before opening it (many camera apps and scanners display the link). Watch out for typos, extra words, foreign country domains or short links that obscure the destination.
4. If you are supposed to “act immediately” somewhere, the following applies: stop. Reputable providers rarely use pressure, especially not via a QR code.

Already scanned? You should take these steps immediately

If something is wrong, close the page immediately and do not enter any data. If you have already paid or entered your access data, act quickly:

• Have the card blocked or contact the bank.
• Change passwords (first the affected account, then the email as the key account) and activate two-factor login where possible.
• Keep an eye on account transactions.

These habits help against quishing

The best defense against the current wave of quishing is simple and effective: keep your smartphone and apps up to date and use a password manager and, where available, passkeys or two-factor methods.

And: Get used to one central principle – QR codes are just convenient shortcuts. For everything that concerns money or identity, the safe route is almost always the same: it’s better to go directly to the app or to the well-known website instead of being guided there by a scan.