QR code scams: what the research says

The short version

• Print codes that open an address your customers recognise, ideally your own website.
• Print codes on the surface, not on stickers, and check public ones for stickers on top.
• Before you open a scanned code, read the address your camera shows.

QR code emails fooled people as often as links

Phishing means fake messages that send people to a fake website. QR code phishing, or quishing, does the same with a QR code instead of a link.

In 2025, a University of Liechtenstein team led by Marie Weinz tested phishing in real organisations, from small businesses to a multinational. They sent more than 71,000 test emails. Some carried a normal link, some a QR code.

The QR code emails got people to the fake page about as often as the link emails. The authors note that QR emails are also harder for email filters to catch, because the address sits inside a picture. The paper was presented at the AsiaCCS 2025 security conference.

Two earlier studies point the same way. In 2022, Sharevski and colleagues had 173 people scan a fake QR code for a COVID-19 pass. 67% were willing to sign up with their Google or Facebook account, and convenience was the reason they gave most. In 2024, Geisler, Pöhn and Hommel put up fake survey posters on a German research campus. A more professional poster that also offered a prize was scanned almost three times as often as a plain one.

If you print QR codes

People can check an address they recognise. Your own website is the easiest to recognise.

• Show your own address where you can. A static code opens your web address directly. With QR Lasts Pro, dynamic codes can use your own domain too.
• Print on the surface. A code printed on a sign is harder to cover than a sticker.
• Check codes in public places. On tables, posters and doors, look now and then for a sticker over your code.
• Say where the code goes. A line under the code such as "Opens yourshop.com/menu" lets people check before they open it.

How to check a code before you open it

1. Read the address first. Most camera apps show it before opening it.
2. Find the site name. Read the address up to the first single /, then look at the last two parts. In parking-city.example.com.pay-now.ru/pay, the site is pay-now.ru. For addresses ending in .co.uk and similar, look at the last three parts.
3. Take care with codes that ask you to log in or pay. Parking, bank and delivery services usually let you pay in their own app or website, which you can open yourself.
4. Feel for stickers on meters and posters before you scan.
5. Do not scan codes in emails you were not expecting. Go to the service directly instead.

How QR Lasts helps

Static codes open your own address, with nothing in between. Every code made here, free or paid, keeps redirecting. The only reason we stop one is abuse, such as a destination that Google Web Risk flags as phishing or malware.

Sources

• Weinz, Zannone, Allodi, Apruzzese, The Impact of Emerging Phishing Threats: Assessing Quishing and LLM-generated Phishing Emails against Organizations, AsiaCCS 2025.
• Sharevski et al., Gone Quishing: A Field Study of Phishing with Malicious QR Codes, 2022.
• Geisler, Pöhn, Hommel, Hooked: A Real-World Study on QR Code Phishing, 2024.

If we have misread a study, tell us and we will correct it.