QR Code Safety: How to Avoid QR Code Scams (Quishing)

Updated November 4, 2026 · 2 min read

QR codes are convenient, but criminals also use them. Malicious QR codes that lead to fake login pages are sometimes called "quishing", short for QR phishing. A few habits keep you safe.

How the scams work

A QR code hides its destination from the human eye. Scammers may stick a fake code over a real one on a parking meter, poster or table, or send codes by email, hoping you will scan and enter a password or payment details on a copycat website.

How to scan safely

Preview the link. Phone cameras show the address before opening. Read it carefully.
Check the domain. Watch for misspellings, extra words, or odd endings.
Be careful with payments and logins. Type the official address yourself if unsure.
Check for stickers. If a code looks pasted over another, do not scan it.
Do not install apps or approve permissions prompted by an unknown code.

Tips for businesses

Print codes on protected surfaces and inspect them regularly.
Place a short readable address next to the code, so people can verify it.
Use your own domain rather than unknown redirect links.
Prefer static codes that point directly to your page. See static vs dynamic QR codes.

About Loqo

Loqo generates codes locally in your browser and never uploads what you enter. See the privacy policy. Create yours at loqo.speakmi.com.

Related guides

Create my free QR code

Loqo stays free thanks to supporters. ☕ Buy me a coffee