QR code or quishing scams

QR Code Scams

QR code or quishing scams

QR Code Scams

QR code scams

QR codes, short for "quick response" codes, are widely used across the globe. People use them to make peer-to-peer payments, check restaurant menus, pay at parking meters, or check into concerts or events. Businesses also use QR codes for advertising and order deliveries, while schools and healthcare providers use them to quickly share information with visitors.

However, in countries like India, the USA, the UK, and Australia, scammers have started exploiting this convenience. They replace real QR codes with fake ones, tricking people into scanning them. Scanning these fake codes can lead people to phishing websites from where scammers can steal their sensitive information like banking credentials, email, passwords, and identity-related information. These phishing scams involving QR codes are also known as ‘Quishing Scams.’

How does a QR code (quishing) scam work?

Fake payment QR codes

Scammers often post fake listings on classifieds and online platforms, offering items that don’t actually exist. When interested buyers contact them, scammers claim that they’ll send a small advance payment to confirm the buyer’s identity or complete the verification. In India, scammers send a QR code, asking the victim to scan it to “accept” the payment of just 1 rupee. However, instead of receiving money, people unknowingly authorise a transfer, losing funds to the scammer’s account instead. This scam is widely reported in India.

Fake parking meter QR codes

In Australia, the USA, and the UK, scammers put fake QR code stickers over real ones on parking meters. When people scan these fake codes, they are taken to a fake website. Once the victim enters their card details, the scammers gain access to their credentials.

In the UK, scammers replaced a genuine QR code with a fake one, leading a 71-year-old woman to a fraudulent website. After stealing her bank and card details, the scammers pretended to be from her bank, tricking her into giving more information. They used this to open a new account in her name and ran up £13,000 in debt.

Malicious QR code

If the QR code contains malware, scammers can install screen-mirroring software or download malicious apps in the background. This fraudulent software gives scammers full access to your device, allowing them to steal sensitive information and authorise transactions without your knowledge. This kind of QR code scam is often reported in India.

Fake package delivery scam

Commonly seen in the US, this scam involves fraudsters sending a fake package to the victim's address with a note inside that reads, 'Scan to see your gift.' When individuals scan the code with their phone camera, scammers gain access to their devices and personal information.

Fear inducing calls/ texts

Individuals are often targeted with fraudulent QR codes in texts or emails claiming there's an issue with your account or warning of “suspicious activity.” The message usually urges recipients to scan the code to “verify” their details. When they scan it, they are redirected to a fake website that asks for sensitive information, such as bank or login details, which the scammers then use to steal personal information. This type of scam has been frequently reported in the US.

How to protect yourself from quishing scams

Only scan QR codes from trusted sources

Scanning codes from unsolicited messages, public places or ads make you more susceptible to scams. As a rule, only scan from verified accounts or official business displays.

Do not forget to check the link

After scanning the QR code, there is a preview URL that pops up -- read it carefully before making any sort of payment. Spell errors and weird URLs are very likely a scam.

Avoid entering sensitive info

Remember, no legitimate website will ask you to enter your credit card details, CVV, or any other sensitive information via QR codes.

Be wary of QR codes in messages

Emails and texts regarding suspicious account activity may appear important, but do not scan any QR code to “find out more” or “resolve” the issue. If the message claims to be from a bank, contact the bank directly or use their official communication channels.

Install Truecaller

Truecaller can detect and block calls or texts from scammers, helping you save time and money. This extra layer of protection makes your communication safer and more secure.

What to do after a QR code scam

  1. Contact local authorities: As soon as possible, gather all the evidence and contact local authorities.
  2. Run an antivirus scan: If you clicked on a suspicious link and suspect that malware was installed on your device, your first step should be to run an antivirus scan. 
  3. Contact your bank: Your bank can help you freeze the account, thereby preventing any unauthorised transactions.
  4. Change passwords: Change the passwords for your emails, online banking, and any other accounts linked to your device as soon as possible.
  5. Monitor your accounts: Keep a close watch on your financial statements for any further suspicious activity.
  6. Report the number: To help others avoid falling for the same scam, it is important to report the number on the Truecaller app.

Protect yourself from QR code scams with Truecaller

Download Free!

Where to report a QR code scam

Conclusion

Scammers are increasingly using fake QR codes to steal personal and financial information. To protect yourself, only scan codes from trusted sources, check URLs carefully, and avoid sharing sensitive details. If you become a victim, report the scam immediately through official channels, run antivirus scans, contact your bank, and update your email and banking passwords.

two screens - one for android and one for iOS, showing truecaller identifying an incoming phone call
DOWNLOAD TODAY

Trust your communicatio­n with Truecaller.

Trusted by over 425 million people, Truecaller is proud to be a leader in caller ID and spam blocking software as well as research around call and SMS harassment.