QR codes themselves are not dangerous. A QR code is just a barcode — a pattern of black and white squares that encodes a short string of text. The danger isn't in the pattern; it's in what the pattern points to, and who printed it. In 2026, that distinction has become more important than ever.
The FBI issued a FLASH alert in January 2026 warning about evolving QR code phishing ("quishing") tactics by the North Korean state-sponsored group Kimsuky, targeting NGOs, think tanks, and foreign-policy experts. A separate Public Service Announcement warned about unsolicited packages containing QR codes used to steal personal and financial information. Cybercriminals are also tampering with physical QR codes on parking meters, cryptocurrency ATMs, and restaurant payment kiosks.
This guide explains how QR code scams actually work, the most common attack patterns in 2026, and ten concrete rules to stay safe.
How a QR code scam actually works
The basic attack has three ingredients:
- A malicious destination. Usually a phishing page mimicking a legitimate login form (bank, email, social media, delivery tracking) or a page that silently downloads malware.
- A QR code that points at it. Generated with a legitimate tool — often the same free generators used by legitimate businesses.
- A way to get the victim to scan it. Stickers over real codes, phishing emails, unsolicited packages, fake parking signs.
The scan itself is harmless. What matters is the split second after — when your phone opens the destination URL. If you don't recognize the URL and you proceed to type a password, enter payment details, or download an app, the scam works. If you notice and stop, it doesn't.
QR code safety is really URL safety. The QR code is just a delivery mechanism.
The six most common attack patterns in 2026
Sticker-over-legit attacks
A criminal prints a QR code pointing at a phishing page, then sticks it over a real code on a parking meter, payment kiosk, restaurant table tent, or event poster. The victim scans what they think is legitimate and gets sent to a fake payment page. This is the dominant pattern for physical-world QR fraud in 2026.
Quishing emails
Email arrives looking like IT, HR, or a SaaS vendor (Microsoft, DocuSign) claiming you need to verify an account or view a document. Instead of a link, the email contains a QR code. QR codes bypass most email security filters, and they force users to jump from work computer to personal phone, away from endpoint protection. The January 2026 FBI Kimsuky warning describes this exact pattern.
Fake delivery notifications
Text or email claims a package delivery failed and asks you to scan a QR code to reschedule or pay a small fee. The code opens a fake carrier website that collects credit card details.
Unsolicited package scams
You receive a package you didn't order. Inside is a card with a QR code and a message like "scan to return" or "scan to claim your prize." The code opens a phishing page. The FBI issued a specific PSA about this pattern in July 2025. If you receive an unexpected package and haven't ordered anything, don't scan any QR code inside it.
Fake cryptocurrency addresses
Scammers post fake crypto donation addresses as QR codes — often impersonating a charity, streamer, or public figure. The victim scans and sends crypto to the attacker. There's no way to reverse the transaction. See the crypto QR code guide for more on verification.
Romance / investment scams with QR codes
A romance or investment scammer eventually asks the victim to scan a QR code to "verify" an account, transfer funds, or install a "trading app." The code leads to malware or credential harvesting. The relationship is the payload; the QR code is the delivery vehicle.
10 rules to stay safe
Follow these and you'll avoid the vast majority of QR code scams.
1. Look at the URL before you tap
Every modern smartphone shows the destination URL before opening it. Read it. If the URL doesn't match what you expected — wrong domain, weird subdomain, unfamiliar country code — don't tap.
2. Never enter credentials after scanning
If a QR code takes you to a login page, stop. Open your banking app or email directly from your phone's app drawer instead. Never type a password into a page you arrived at via QR scan unless you fully trust the source.
3. Treat QR codes in unsolicited email as phishing
Email you didn't expect, with a QR code inside, is phishing until proven otherwise. Don't scan. Verify out-of-band — call IT, ask a coworker in person, check the vendor's official website.
4. Check physical codes for tamper stickers
Before scanning a code on a parking meter or payment kiosk, look at it. Is it a sticker on top of another sticker? Is it peeling? Is the print quality weirdly low? All signs of tampering. If in doubt, use a different payment method.
5. Don't scan codes from unsolicited packages
If you receive a package you didn't order, don't scan any QR codes inside it. FBI-documented attack pattern.
6. Don't scan codes on random flyers or street signs
Especially anything promising free money, gift cards, prize wins, or contest entries. Almost always scams.
7. Use a scanner that shows URL preview
iPhone's native camera app and most Android camera apps show the URL before opening. Don't install a separate "QR scanner" app — many are themselves malicious, and the native camera is better anyway.
8. Never install apps from QR code links
If a QR code takes you to a page asking you to install an app or APK file, close the page immediately. Only install from the official App Store or Google Play, after searching directly.
9. Assume crypto QR codes are scams until proven otherwise
A QR code asking for cryptocurrency — especially unsolicited — is almost certainly a scam. Crypto transactions are irreversible. Verify addresses through official channels before sending.
10. Keep your phone's OS updated
Several malware payloads delivered via QR codes exploit outdated browser or OS versions. Running the latest iOS or Android closes those paths. One of the cheapest, highest-impact security habits you can have.
Create safe, transparent QR codes
QuicklyGenerateQR produces clean, non-tracked, transparent QR codes. Static codes expose the full URL; dynamic codes use a predictable redirect domain you can recognize. No hidden layers.
What legitimate QR code generators do
Not all QR code tools are equal. A trustworthy generator has a few properties worth knowing:
- The generator itself doesn't log your data. We produce the code, you download it, and nothing about the content is tied to you unless you save it to an account.
- URLs encoded in static codes are visible to anyone — including you. There's no hidden redirect layer in a static QR code.
- Dynamic codes use a transparent redirect through a known domain. When you create a dynamic code on QuicklyGenerateQR, the redirect goes through
quicklygenerateqr.codes/r/...— predictable and recognizable, not a random obfuscated short link. - The full destination URL is shown in your dashboard. You can always check exactly where your own codes point.
Red flags on a suspicious QR generator: the shortened URL uses a random domain nobody recognizes, the tool requires permissions it shouldn't need (camera/file access), it bundles tracking you didn't opt into, or the terms of service reserve the right to change your destinations without notice.
For businesses: how to protect customers
If you print QR codes for customers, you're also responsible for the scanning experience:
- Print codes with a visible brand logo in the center. A tamper sticker can't easily match this, so tampering becomes obvious.
- Laminate or seal physical codes so stickers can't be applied on top.
- Pair every QR code with a visible URL or short text explaining where it goes. "Scan to join our newsletter — or visit example.com/signup directly."
- Use dynamic codes so you can rotate them if one is compromised, without reprinting.
- Monitor scan counts and patterns. If your dashboard shows scans from a region you don't operate in, or an unexplained traffic spike, investigate.
The honest takeaway
QR codes are about as dangerous as any other clickable link — which is to say, dangerous only if you don't pay attention to where they lead. The vast majority of scans are completely safe. The vast majority of scams fail if the victim reads the URL before tapping.
If you remember one thing: the QR code is not the threat; the destination URL is. Treat it like any other link. Check before you tap.
Create QR codes you control
QuicklyGenerateQR produces clean, non-tracked, transparent QR codes for legitimate business and personal use. Start with the free QR code generator or create a free account to manage dynamic codes with built-in analytics.
Tagged