QR Code Fraud (Quishing)

Physical sticker scams were first widely reported on parking meters in Austin and San Antonio, Texas in January 2022; email quishing was named by security vendors in 2021-22, and UK police recorded a fourteen-fold rise in reports over five years to 2025.

QR codes were invented in Japan in 1994 but only became a fraud vector when phone cameras read them natively (2017) and the pandemic made 'scan to pay' and 'scan to view the menu' universal. 'Quishing' (QR phishing) was named by security firms around 2021-22 as emails began carrying QR codes to evade link filters. The physical variant, a sticker placed over a real payment code on a parking meter, e-bike or restaurant table, was first widely reported in Texas (Austin, San Antonio) in early 2022 and in UK car parks in 2023. UK Action Fraud logged 784 reports and £3.5 million lost in the year to April 2025; the FTC and FBI issued warnings in 2023-2025.

The victim scans a code that looks legitimate: a sticker over a parking-meter code, a code in an email posing as a bank or HR department, a code on an unsolicited package, or a merchant code swapped for the fraudster's own in a shop or clinic. The link opens a cloned payment or login page that takes card details, one-time codes and personal data, or simply routes the payment to the criminal's account. Because the URL is hidden inside the code and opened on a phone, normal link checks are bypassed.

A sheet of printed stickers or a QR image in an email costs almost nothing, hides the destination URL, and bypasses corporate link filters and users' habits. Reports are rising fast (UK monthly reports rose from 115 in 2024 to 167 in early 2025) but most stickers are removed by councils without any suspect identified; the few convictions are of local merchants' staff or receipt-editing groups in Asia.

The best national figure is UK Action Fraud's £3.5 million (about $4.5 million) in the year to April 2025, which it calls an underestimate; no US body publishes a quishing total. The largest linked case, the Aether network, generated over EUR 300 million from card fraud fed partly by quishing. Victims also lose bank logins and identities, as in a 71-year-old Thornaby woman whose scan led to a £7,500 loan in her name.