QR safety and quishing
Quishing is phishing that starts with a QR code. The barcode is not the scam. The page, the payment form, or the WiFi network behind it is. The scan is just a way to skip the moment where you would have looked at a web address.
Updated 28 October 2026
Read the preview before you tap
The built-in camera on a current iPhone, and the scanner on a current Android phone, shows the destination before it opens. That line of text is the whole defense, and it only works if you read it. Look for a domain you already know. A menu at a restaurant should be the restaurant’s own site, or a host you have heard of. A parking meter should be the city or the operator named on the machine. A package notice should be the carrier that actually has your parcel, not a lookalike with an extra word or a swapped letter.
Short links hide that destination. bit.ly and similar hosts are not malicious by themselves, but the preview cannot show you the final page. Be slower when the code is on a letter, a meter, or a sticker you did not expect. Type the address yourself if payment or a password is involved. A real carrier will let you track a parcel from their site without demanding a card number first.
A code that asks you to install an app, to “update your account,” or to re-enter a password is the same email scam in a different costume. Close it. Open the service from the app you already installed, or from a bookmark. Do not use the code as the way back in.
Stickers on stickers
The common physical attack is a new code stuck on top of a legitimate one. Parking pay stations, scooter rentals, museum donation signs, and restaurant table tents are all easy targets because the original code is a replaceable square. Look for a sticker edge, a code that sits slightly off the printed artwork, or a laminate that does not match the rest of the sign. If the sign was clearly printed as one piece and the code is part of that print, tampering is harder. If the code is a separate label, assume it might have been swapped and check the domain anyway.
The same trick shows up on paper letters: a “delivery held” notice with a code and no other way to reach the company. The letter is the whole scam. There is no parcel.
If you publish codes, make a swap obvious. Print the symbol as part of the artwork rather than as a loose sticker when you can. Run a color or a line of type through the margin so a new sticker covers something visible. Laminate signs you control. None of this stops a determined person. It makes the casual swap look wrong, which is what you can actually hope for. Replacing your own WiFi card by stacking a new sticker on the old one trains guests to accept layered stickers. Take the old one off. The WiFi guide covers that for passwords specifically.
WiFi codes from people you do not know
A WiFi QR code joins your phone to a named network and may hand over a password. A code on a cafe table can be the cafe’s guest network. It can also be a phone in someone’s bag broadcasting a network with the cafe’s name. The camera will not tell you which radio you are about to use. Prefer a code that is printed on the menu the staff handed you, or a password the staff will say out loud. Avoid joining from a code that was taped on later.
Once you are on a network you do not trust, treat it as public. A VPN you already use is appropriate. Logging into a bank on a network you joined from a stray sticker is not. Public WiFi advice did not change because the password arrived as a barcode.
Payment pages
A code is a bad place to start a card payment unless you already know the merchant and the preview shows their domain. Street posters, pop-up stalls, and “pay the meter” stickers are where quishing payment pages show up, because the buyer is in a hurry and the real payment kiosk is two steps away. If the only way to pay is the code, and the domain is unfamiliar, pay another way or leave. A padlock icon on the next page only means the connection to that site is encrypted. It does not mean the site is the city.
Publishing a code people can check
When you create a code on QRazyQR, you can see the fields, and the symbol contains those fields. It does not contain a link back to us, and we never receive the payload, so we cannot review it, block it, or take it down after you download it. That limit is also in the terms. You are the publisher.
- Encode your own domain, with
https://, for anything that opens a page. A static code of your URL is easier for a visitor to trust than a short link, because the preview shows the real site. The difference is covered in static versus dynamic. - Do not use an open redirect on your site as the destination (“example.com/go?url=…”). The preview looks like you. The next page might not.
- Scan the finished print and read the preview yourself before a box of cards or a run of posters ships. A typo in a URL is an honest mistake that still sends people to the wrong host. Someone else can register that host.
- For WiFi and vCards, the preview should show a join sheet or a contact, not a website. If it shows a website, you made a URL code by accident.
- Do not point a code at a page that asks for a password unless the visitor would have expected that page. A menu should not land on a login.
Contrast and size are part of safety too. A code that fails to scan gets covered later by a “helpful” sticker. Print it large enough, dark on light, with a real margin, using the print guide and the color guide. A code people can read on the first try is less likely to be replaced by one they should not trust.
If you believe a guide on this site describes a risk badly, or you found a QRazyQR page being copied to impersonate the generator, email contact@qrazyqr.com. We cannot disable a symbol that was saved to someone else’s phone. We can correct a page on this domain.