Think Twice Before Scanning That QR Code

The Little Square That Took Over the World

There’s a certain irony in how something so visually chaotic a jumbled mosaic of black and white pixels became one of the most trusted symbols of modern convenience. QR codes are everywhere now. Restaurant menus. Airport check-in kiosks. Parking meters. The side of a cereal box. You point your phone, the camera blinks, and in under a second you’re somewhere else entirely. No typing, no searching, no friction. It feels almost magical.

That frictionlessness is exactly what makes them dangerous.

The QR code was invented in 1994 by a Japanese automotive engineer named Masahiro Hara, who needed a faster way to track car parts on an assembly line. For the better part of two decades, it was a niche industrial tool the kind of thing that showed up in trade magazines, not on city streets. Then smartphones happened. Then the pandemic happened. Suddenly, handing someone a physical menu felt like a biohazard, and contactless everything became the cultural mandate. QR codes had their moment, and they never left.

Global adoption exploded. By 2023, more than 89 million people in the United States alone scanned a QR code at least once per month. The number keeps climbing. And with that scale came something else entirely: criminals who understood that the best way to exploit trust is to hide inside it.

Quishing The Attack You Won’t See Coming

The term sounds almost comical. “Quishing” a portmanteau of QR code and phishing is now a recognized and rapidly growing category of cybercrime. The mechanics are deceptively simple. A bad actor generates a QR code that points to a malicious URL, then places it somewhere a victim will naturally scan it. The QR code itself looks completely normal. There’s no misspelled word, no suspicious sender name, none of the classic red flags that years of phishing awareness training taught people to spot. The code is just a code. A pattern. Inscrutable to the human eye.

That opacity is the whole point.

When you receive a suspicious email, you can hover over a link and see where it actually goes. You can read the URL, parse it, decide whether it looks legitimate. A QR code denies you that preview. The destination is locked inside the pattern, invisible until your phone resolves it and by then, you may have already handed over a credential, downloaded something, or authorized a payment you didn’t intend to make.

In2023 and2024, security researchers documented a surge in quishing campaigns targeting corporate employees. One particularly effective attack involved fake Microsoft multi-factor authentication prompts delivered via QR codes embedded in emails. Because many email security gateways scan links but not images, the QR codes sailed past enterprise defenses undetected. Employees who had been trained for years not to click suspicious links saw a QR code, reached for their phones, and scanned without a second thought.

Physical World, Digital Threat

The digital attack surface is concerning enough. But quishing has a physical dimension that makes it considerably more unsettling.

In cities across the United States and Europe, criminals have been placing fake QR code stickers over legitimate ones on parking meters, at EV charging stations, on restaurant tables, in hotel lobbies. The sticker is small and neat. It looks like it belongs there. A driver trying to pay for parking in San Antonio, Texas, scans what they believe is the official city code. They’re taken to a convincing payment page. They enter their credit card number. They’ve just handed their financial information to a stranger who may be watching from a block away.

The San Antonio incident wasn’t isolated. Similar scams have been documented in Austin, Houston, Nashville, London, and Berlin. The UK’s National Cyber Security Centre issued a specific advisory about QR code fraud at parking facilities. The FBI released a public service announcement. Yet awareness remains remarkably low, in part because the scam preys on moments of low cognitive engagement you’re running late, the meter is ticking, you’re doing what you’ve done a hundred times before.

Habit, it turns out, is a vulnerability.

Why Your Brain Doesn’t Raise the Alarm

There’s a useful concept in behavioral psychology called “automation bias” our tendency to over-rely on automated or technology-mediated prompts and to under-scrutinize them. When a machine tells you to do something, or when a well-established routine is involved, the critical mind tends to disengage. You’re not being careless. You’re being efficient, in exactly the way human cognition evolved to be.

QR codes exploit this beautifully. Scanning has become reflexive. The behavior is paired with immediate reward information appears, the process is complete, you move on. There’s no moment of pause built into the interaction, no interface element asking “are you sure?” The action and its consequence are nearly simultaneous.

This is fundamentally different from clicking a link on a desktop. Desktop browsers render full URLs in the address bar. There are green padlock icons, familiarity signals, the visual context of a website you recognize. Mobile browsers, which handle the vast majority of QR code scans, often truncate URLs and skip visual trust signals in favor of a cleaner interface. You’re operating with less information at the very moment you need more.

Security experts call this the “last mile” problem. You can harden servers, encrypt databases, and run phishing simulations until employees can spot a spoofed email at forty paces and still lose to a sticker on a parking meter.

What Careful Actually Looks Like

None of this means QR codes should be abandoned. That ship has sailed, and the technology itself is genuinely useful. But “careful” in this context needs to mean something more specific than a vague sense of caution.

The first and most actionable habit is checking the URL before you proceed. Most phones now display a preview of the destination when you scan a URL that appears before you tap through. Look at it. Does the domain match the brand or institution the code is supposedly from? A parking payment code for the city of Chicago should point to a Chicago city domain, not a randomly generated string at a .info or .xyz address. If something looks off, it probably is.

Context matters enormously. A QR code on a billboard, embedded in a brand’s national advertising, carries a different risk profile than one on a handwritten sign at a pop-up shop. Codes in locations where anyone could have placed a sticker public kiosks, restaurant tables, shared lobbies deserve more scrutiny than ones printed directly on packaging or mailed in official correspondence.

For anything involving payment, authentication, or account access, consider whether the QR code is actually necessary. Many of the systems that use them parking apps, banking apps, restaurant menus also have direct, typeable web addresses. Typing is slower. It’s also verifiable. For high-stakes interactions, that tradeoff is worth making.

Organizations deploying QR codes for employee-facing processes internal authentication, HR portals, IT helpdesks should treat them with the same rigor as any other attack surface. That means staff training that specifically addresses QR-based phishing, periodic audits of physical QR code placements in office spaces, and clear internal guidance on what a legitimate internal QR code destination should look like.

The Convenience Bargain

Every time technology removes friction, it also removes the moment of consideration that friction created. We used to have to type in a web address character by character, which meant we actually read it. Card swipes replaced handwritten signatures, which nobody mourns except perhaps as the last vestige of a system where a human being had to look at your face and compare it to a piece of paper. Friction was slow. Friction was also, sometimes, the point.

The QR code is a particularly efficient frictionlessness. You see a pattern, you point a camera, and your identity, your location, and your financial information all travel somewhere at the speed of a network handshake. Most of the time, they travel exactly where they were supposed to go.

The whole game for the people designing these scams is that you never pause long enough to wonder whether this time might be different. A moment’s hesitation that reflexive, almost instinctive second look is the only defense that can’t be circumvented by clever code or a convincing sticker.

Think twice. Not because QR codes are inherently untrustworthy. But because the people who abuse them are counting on you not to.