QR code ‘quishing’ scams costing consumers £10,000 a day – here’s how to stay safe

QR codes are everywhere these days - in pubs, restaurants, car parks, train stations, property ads, and even on posters or tickets.

They’re a quick and convenient way to access websites, menus or payment pages by simply scanning a small black-and-white square with your phone.

But what many people don’t realise is that these simple codes can also be used to carry out high-tech scams - a tactic known as ‘quishing’.

What is ‘quishing’?

Quishing is short for QR code phishing. It’s when criminals use fake QR codes to trick people into visiting malicious websites or downloading dangerous software onto their phones.

These fraudulent QR codes can appear almost anywhere, on posters, in emails, on parking meters, or even printed onto fake tickets. Once scanned, the code might take you to a website that:

• Looks legitimate but is designed to steal your login details, banking information, or personal data.
• Prompts you to download malware, including ransomware, which can lock or damage your device.

Why it’s so dangerous

One of the reasons quishing is so effective is because it bypasses traditional security filters.

Many email filters and cybersecurity tools are not yet trained to detect QR codes as potential threats, especially when they’re embedded in images or documents.

This makes it easier for scammers to slip through the cracks and harder for users to tell the difference between real and fake.

Quishing is on the rise

According to Action Fraud, between April 2024 and April 2025, there were 784 reports of quishing scams in the UK.

These scams cost victims nearly £3.5 million, which equates to more than £10,000 a day, and more than two incidents daily.

How to protect yourself from QR code scams

You don’t have to stop using QR codes altogether, but a few simple habits can help keep you safe:

Only scan trusted codes

Avoid scanning QR codes from unknown or suspicious sources, especially on posters in public spaces, stickers or leaflets. If something looks tampered with, such as a sticker placed over another QR code, then don’t scan it.

Double-check email sources

If you receive a QR code via email, even from someone you know, confirm it’s legitimate by contacting them through a separate method, like a phone call or text message.

Use your built-in scanner

Stick to your phone’s built-in camera to scan QR codes. Avoid downloading third-party scanner apps, which can be less secure and more vulnerable to abuse.

Install mobile security software

A good mobile antivirus app can help detect and block dangerous websites or malware if you do accidentally scan a harmful code.

Watch for classic phishing signs

Be wary of messages or websites that:

• create a sense of urgency, such as ‘act now’, ‘limited time’
• appeal to your emotions, such as sympathy, fear or excitement
• contain spelling or grammar mistakes

If something feels off, trust your instincts and don’t proceed.

How to report a QR code scam

Reporting scams doesn’t just help you, it helps others avoid becoming victims too. And remember, there’s no shame in falling for a scam. These tactics are designed to be highly convincing.

• You can report the scam to Citizens Advice and they’ll pass information onto Trading Standards who will decide whether or not to investigate.  

• It’s also a good idea to report scams to Action Fraud on their website or by calling 0300 123 2040.  

Scammers are constantly evolving their tactics and QR code scams are just the latest example.

Stay alert, stay informed and don’t let your guard down just because something looks simple or familiar.