Is that QR code safe to scan?

QR phishing — known in the security industry as quishing — exploits the blind trust most people place in physical objects. A scammer prints a fake QR code, tapes it over the real one on a parking meter, restaurant table, package delivery notice, or government notice board. You scan it expecting to pay for parking or see a menu. Instead you land on a page that looks identical to your bank, a parcel-tracking portal, or a Microsoft sign-in screen.

The attack works so well because QR codes are opaque by design — there is no URL to read, no hover-preview to check. The threat actor counts on you tapping the camera notification without thinking. Unlike email phishing, these attacks bypass corporate email security gateways entirely, and they target mobile users who are often mid-task, distracted, and less security-aware.

Common delivery mechanisms include:

• Parking meters & ticketing machines — stick-on codes that redirect to fake payment pages collecting card details.
• Fake restaurant menus — especially common where restaurants legitimately replaced physical menus with QR codes post-pandemic.
• Parcel delivery scams — SMS or printed notices with a QR code claiming to re-schedule delivery, leading to credential-harvest or premium-rate subscription pages.
• Shortener laundering — chaining bit.ly → another shortener → yet another hop before the final phishing page. Each hop adds obfuscation; most scanners only check the first URL.

The tell-tale signs are: URL shorteners hiding the destination, look-alike domains using punycode or subtle misspellings, newly registered domains (days or weeks old), and redirect chains of three or more hops. This checker inspects all of them.