As the 2026 holiday season approaches, scammers are ramping up a tactic that exploits the trust people place in QR codes: quishing — QR code phishing. A fake sticker over a parking meter, a tampered code on a restaurant bill, a convincing email with a QR that leads to a credential harvester — these attacks are growing globally, and they spike during high-traffic shopping and travel periods.

This post covers two angles: how to protect yourself when scanning codes in the wild, and how to make the QR codes your business prints harder to spoof and easier for customers to trust.

What is quishing?

Quishing is phishing delivered via QR code. Instead of a suspicious link in an email, the attacker uses a QR code that, when scanned, sends the victim to a fake login page, a malware download, or a payment form designed to steal credentials or money.

The technique works because QR codes obscure the destination URL — you cannot read the link before scanning, and many people tap through without checking where they land.

Recent warnings from around the world

Quishing is not hypothetical. Law enforcement and security organizations are issuing active warnings:

Dubai (Oct 2026): Dubai Police's eCrime Hub warned residents about fake QR codes appearing on parking meters, restaurant tables, and public signage. Gulf News reported four warning signs: odd placement or a sticker over another code, a site asking for ID/banking/passwords, unusual design or URL, and unexpected app or file download prompts.
Brazil (Oct 20, 2026): Febraban, the Brazilian banking federation, issued an alert about fake stickers placed over legitimate payment codes in bars, restaurants, and parking lots, plus tampered QR codes on printed invoices (boletos). They advise always checking the recipient name and amount in your banking app before confirming any QR-initiated payment.
Russia (Sept–Oct 2026): Kaspersky reported a wave of corporate emails impersonating government agencies, each containing a QR code leading to fake postal-tracking payment pages. Kaspersky blocked more than 800 such messages since September 11.
Texas (Oct 5, 2026): The Fort Bend County Sheriff's Office warned residents about fake QR codes appearing on parking meters, citing earlier FTC warnings about the same tactic.
California (Oct 20, 2026): CSU Channel Islands issued a holiday-season advisory reminding students and staff to be cautious with QR codes in emails and public spaces.

The pattern is clear: quishing is a global, active threat — not a future concern.

Part 1: How to spot a fake QR code (for everyone who scans)

Use this checklist before you scan any QR code in public or from an unexpected source:

1. Look for physical tampering

Scammers often stick a fake code over a legitimate one. Check for:

A sticker placed over another QR code
Edges that don't align with the surrounding material
Different paper stock, print quality, or color compared to the sign
Codes on parking meters, payment terminals, or restaurant tables that look hastily attached

If the code looks like it was added after the fact, treat it as suspect.

2. Preview the URL before opening

Most phone camera apps show a preview of the URL before you tap. Stop and read it:

Does the domain match the business you expect? A parking app code should go to the parking company's domain, not a random string of characters.
Watch for typosquatting: paypa1.com instead of paypal.com, or parking-dubai-pay.xyz instead of the official municipal site.
Be wary of URL shorteners (bit.ly, tinyurl.com, etc.) on payment or login codes — legitimate businesses usually use their own domain.

3. Distrust urgency and immediate payment requests

Scam pages often push you to act fast: "Pay now to avoid a fine," "Your package will be returned," "Account suspended." Real services rarely demand immediate card details via a QR code with no prior notice.

4. Never enter banking or ID details from an unexpected code

If a QR code leads to a page asking for your bank login, credit card number, national ID, or password — and you did not initiate a payment yourself — stop. Go directly to the official app or website instead.

5. Verify payments in the official app

Febraban's advice for Brazil applies everywhere: if a QR code initiates a payment, check the recipient name and amount in your banking app before you confirm. If the details don't match the merchant you expect, cancel.

6. Install apps only from official stores

If scanning a code prompts you to download an app or APK file directly, do not install it. Legitimate apps are available through the App Store or Google Play. A QR that bypasses the store is a red flag.

Part 2: How to protect the QR codes your business prints

If you run a business that uses QR codes — menus, payment, product info, check-in — scammers can target your customers by overlaying fake codes on your materials. Here is how to make your codes harder to spoof and easier for customers to trust.

1. Brand your codes with a logo and consistent colors

A plain black-and-white QR code is easy to replace without anyone noticing. A branded code with your logo embedded and your brand colors is much harder to fake — customers will notice if a sticker looks different from your usual materials.

In Vyntrix QR's Studio, you can add a logo, set foreground/background colors, and download print-ready files for free. For design guidance, see our posts on creating a QR code with a logo and logo design best practices.

2. Print the destination URL in readable text

Next to your QR code, print the short URL or domain in plain text: menu.yourrestaurant.com or pay.yourshop.com. This lets cautious customers verify where the code should go. If a scammer sticks a fake code over yours, the printed URL will not match the destination — an obvious tell.

3. Use tamper-evident placement

Laminate table tents so stickers cannot be applied without damaging the surface.
Print codes directly onto materials rather than using adhesive labels when possible.
Recess codes into signage or behind protective covers.
Inspect your public-facing codes regularly — weekly or daily for high-traffic locations.

4. Use your own domain, not third-party shorteners

A static code pointing to menu.yourdomain.com is more trustworthy than one pointing to bit.ly/xyz123. If you need editable destinations or scan analytics, use a dynamic QR code with a custom short-link slug on a domain you control. Our static vs dynamic cost breakdown explains when each approach makes sense.

5. Add a call-to-action frame

A frame around the code that says "Scan to view menu" or "Pay with [YourBrand]" reinforces authenticity. It is another element a scammer would have to replicate, and it tells customers exactly what to expect.

6. Keep codes scannable

All the branding in the world will not help if the code does not scan. Use adequate error correction for logos, follow print best practices, and test your codes at the expected scan distance before you print a batch.

How Vyntrix QR fits in

Vyntrix QR is a free, in-browser QR code generator that runs client-side for static codes — your data stays in your browser. You can add a logo, choose brand colors, and export SVG or PNG without creating an account.

For businesses that need editable destinations or scan analytics, Pro unlocks unlimited dynamic codes with custom slugs and full analytics. Either way, the goal is the same: give you codes that are easy to brand, hard to fake, and straightforward to print correctly. For a full privacy breakdown, see how static QR generation stays private.

Checklist summary

For scanners:

Look for stickers or tampering.
Preview the URL before tapping.
Distrust urgency and immediate payment demands.
Never enter banking or ID details from an unexpected code.
Verify payment details in your official banking app.
Install apps only from official stores.

For businesses:

Brand codes with your logo and colors.
Print the destination URL in readable text.
Use tamper-evident placement and inspect codes regularly.
Point static codes to your own domain.
Add a call-to-action frame.
Follow print best practices so codes scan reliably.

Quishing Season: How to Spot a Fake QR Code (and Protect the Codes Your Business Prints)