Stay Alert – Beware of Quishing (QR Code Scams)

Quishing, short for QR code phishing, is an identity fraud scam utilizing QR codes. Scammers post physical images of QR codes in a high-traffic location or send them via email or text message.

If you scan such a QR code, it typically takes you to a fake login page of a fraudulent website, where the scammer lures you into providing personal or financial information such as account usernames and passwords, Social Security number, date of birth, or credit and debit card numbers. In quishing schemes, scammers often attempt to disguise themselves as a government agency, bank, or other company to lend legitimacy to their claims.

QR codes have increasingly become targets for malicious use because they're everywhere and many people scan them without giving it a second thought. Another reason QR codes have increased in popularity with scammers is that more safeguards have been put into place to tamp down on traditional email phishing campaigns. A 2025 study from cybersecurity platform KeepNet Labs found that 26 percent of all malicious links are sent via QR code.

The best defense against quishing is to not scan unwanted or unexpected QR codes. When you do scan a QR code, carefully check the URL address of the resulting link.