Have you ever scanned that little square code on a restaurant menu, a parking meter, an email, or a poster without a second thought? One of the fastest-growing scams of 2026 is built on exactly that habit: quishing (QR + phishing) — phishing hidden inside fake QR codes.
This guide explains what quishing is, why it's so effective, and how to check a suspicious QR code without putting your phone at risk.
What is quishing, and why is it so dangerous?
Quishing hides a malicious link inside a QR code instead of plain text. What makes it dangerous is simple: unlike a link, you can't see where a QR code goes before you scan it. The moment you raise your phone and scan, you may be redirected to a fake banking or payment page, or a malicious site.
Because a QR code is an image, it also slips past traditional email security filters that scan text. That's why it's spreading fast: according to research, quishing rose from 0.8% of all phishing attacks in 2021 to 12% in 2025 — roughly a fivefold increase in a few years.
How to spot a fake QR code
- Be wary of unexpected QR codes: don't scan codes in emails, even if they look like they're from a company you know.
- Watch for stickers: a fake QR sticker may be placed over the real one on a parking meter or poster.
- Don't trust urgency: "Your account will be closed, scan now" pressure is a classic trap.
- Check the address: after scanning, make sure the URL is really the domain you expect (look for tiny letter changes or odd extensions).
The safest move: see where a QR goes before you scan it
The QR code's core weakness — you can't see its destination before scanning — is also the key to protecting yourself. Instead of scanning a suspicious QR with your phone, feed its image to a reader and see the URL as text first.
👉 swapfile.io QR code reader — upload a screenshot or photo of the QR, and it shows you the text or link inside it, entirely in your browser, with nothing uploaded. You see where the link goes without opening it, then decide.
Want to create your own QR safely? Use the QR code generator to turn text or a link into a PNG or SVG — again, entirely on your device.
In short
Quishing is on the rise because QR codes feel trustworthy and their destinations are hidden. Keep the rule simple: don't scan unexpected QR codes, and check where one goes before you scan it. When you see a suspicious code, don't risk your phone — feed its image to the QR reader, read the URL, then decide.