Every surge in QR code use brings a matching surge in QR code abuse. Security firms tracking "quishing" — QR code phishing — report year-over-year growth as scammers follow the public from paper menus to parking meters to gift registries. The FBI has repeatedly warned about malicious codes stickered over legitimate ones, and the seasonal pattern is consistent: wherever people are rushing, scammers are printing.

The uncomfortable truth is that a QR code is just a link you can't read. Your phone shows you the destination after scanning — sometimes not even then. That makes every code a small act of trust, and trust is exactly what attackers borrow.

Try VS Code Editor Online — free, no sign-up, and it runs entirely in your browser.

This guide is the defensive half and the honest half: how to spot the malicious ones, and — if you run a business, a fundraiser, or a wedding — how to publish codes that don't train your customers to be victims.

The Five Places Quishing Strikes This Season

Parking meters. The classic. A sticker with a fake code placed over the city's real one. You scan, land on a convincing payment page, enter your card, and pay the scammer while your meter runs out. Cities from coast to coast have reported these.
Restaurant tables. Either a sticker over the menu code or a "scan to pay" overlay. The fake page harvests card details or installs a payment-prompt scam.
Gift exchanges and charity drives. Seasonal giving is prime time: fake "donate" codes on charity flyers, or codes added to gift-wrap stations directing to credential pages.
Package slips and missed-delivery cards. "Scan to reschedule" — the code leads to a shipping-carrier lookalike that asks for a card "to verify delivery," then charges it.
Public posters and transit ads. Apartment listings, lost-pet flyers, event posters — anything with a code can carry a stickered replacement.

The pattern uniting all five: urgency plus a payment field. Legitimate QR destinations almost never need your card in the first sixty seconds.

The 10-Second Inspection That Catches Most Malicious Codes

Before scanning anything in public:

Look at the sticker itself. Is it crooked, layered over another sticker, a different size than the official signage, or printed on a label that doesn't match? Stickers are the attack. Official codes are usually printed into the sign itself.
Trace the surface. Run a fingernail over the code. A replacement sticker has edges. A printed code doesn't.
Check the URL the moment it appears. Your phone previews the destination before opening. .com vs .xyz matters. So does the domain: city-parking-pay.com ≠ cityparking.gov. If the preview hides the URL, don't open it.
Never enter a card in the first screen. Real parking and payment flows show your plate, meter number, or session before asking for money. A page that leads with a card form is a scam page.
When in doubt, type it. Every legitimate QR destination is also reachable by typing. Search the official site instead and navigate to payments there. Ten seconds of typing beats a week of chargebacks.

If You Already Scanned Something Sketchy

Scanning alone is usually survivable — the danger is what you did next.

Entered a card? Call the bank, freeze the card, dispute charges. Do it from the bank's app, not from any link on the page you landed on.
Entered a password? Change it everywhere it was reused — starting with email, because email resets everything else.
Installed a "profile" or app? Delete it, then check phone settings for new device-management profiles (iOS: Settings → General → VPN & Device Management).
Got a "verify your account" text after scanning? That's the second stage. Don't reply; report it.

The Honest Half: Making QR Codes That Deserve Trust

If you publish codes — menus, flyers, Wi-Fi cards, event registrations, donation drives — you are part of the trust ecosystem. Two rules:

Show the destination next to the code. Print the URL beneath it. People can verify before scanning, and scammers' stickers can't fake the printed text. This single habit defeats sticker attacks on your signage.

Generate the code yourself, from a tool you control. Free "QR maker" sites have been caught injecting redirect links that they later sell or repoint. A QR Code Generator that renders the code locally in your browser — no account, no server-side redirect, no expiry games — produces a code whose destination is exactly the URL you typed, forever.

For Wi-Fi sharing at a business or event, a QR code beats reading a password aloud: the same generator encodes Wi-Fi credentials directly, so guests connect without the password ever appearing in plaintext on a sign. For print materials, generate at high resolution (the tool exports SVG/PNG) so codes stay crisp at any sticker size.

FAQ

What is quishing? Phishing delivered by QR code. The code hides its destination, so victims land on attacker pages that impersonate payment, delivery, or login sites.

Can a QR code itself infect my phone? Not by being scanned — a code is just a link. Danger comes from what you enter or install after landing.

Are restaurant QR menus safe? Mostly, yes. Verify the sticker isn't an overlay and that the menu URL matches the restaurant's actual domain. If it's printed into the table sign, risk is low.

What do I do about a fake code on a public meter? Don't scan it. Report it — most cities have a 311 line or parking-app report function — and pay in the official app.

How do I check a QR code is safe before scanning? You mostly can't — the destination is hidden by design. The inspection is physical (sticker, edges, printing) plus the URL preview the moment your phone offers it.

Is it safe to use QR codes for my business? Yes — print the URL alongside, generate from a trusted QR Code Generator, and check your own signage periodically for sticker overlays.

Why do scammers love QR codes? They bypass the URL-checking habits people learned on email links. The defense is the same habit, one step later: read the URL before you act.