Quishing Explained: QR Code Phishing in Texts and Emails Is the Scam Nobody Is Talking About Enough
Quishing, phishing hidden inside a QR code, lets scammers bypass most of what people know about email phishing. The numbers are getting hard to ignore, and the fake ticket scam is just one version of it. (New here? Start with what quishing is and how to protect yourself.)
Want every code checked automatically? ScanLikely shows you where a QR code leads before your phone opens it.
Get ScanLikely (iPhone) Get ScanLikely (Android)Most people know not to click a suspicious link in an email. Scammers know that too. So they stopped using links and started using QR codes instead. You get a text or an email with a QR code, you scan it with your phone, and you end up on a phishing site. The QR code itself looks harmless, it's just a pattern. That's the whole point.
CNBC reported that QR phishing attacks increased fivefold in 2025. Keepnet tracked QR phishing emails jumping from 47,000 in August to over 249,000 by November of the same year. This is called quishing, and it's getting worse.
What these messages look like
The messages are designed to make you act fast. Common ones right now:
- Fake delivery notices. A text or email saying your package couldn't be delivered. Scan the QR code to reschedule. It takes you to a fake UPS, FedEx, or USPS page that asks for a small redelivery fee and your card number.
- Bank and account alerts. An email claiming there's suspicious activity on your account. Scan to verify your identity. The QR code goes to a site that looks exactly like your bank's login page.
- Toll violation notices. A text saying you have an unpaid toll and will face additional fees. Scan to pay. Florida's Highway Safety office flagged a surge of these in early 2026, with reports coming in from states across the country.
- Government and IRS impersonation. Messages claiming you owe taxes, have an outstanding fine, or need to verify your identity with a government agency.
- Fake notices on windshields. This one is physical but the mechanism is the same. A convincing citation with a QR code that goes to a spoofed municipal payment site. BleepingComputer documented confirmed cases and Boston PD issued a public warning in March 2026. The FTC has specifically called out QR code stickers being placed over legitimate parking meter codes as well.
Why QR codes work better for scammers than regular links
A few things work in their favor.
- Email security filters are built to catch malicious URLs. A QR code image in an email doesn't trigger those filters the same way.
- When you scan a QR code with your phone, most people don't look at the URL before the page loads. With a link you can at least hover over it first.
- The urgency in the message does the rest. If you think you have a package held, a toll fine growing, or your bank account compromised, you move fast.
What to do
- If a text or email sends you a QR code out of nowhere, be skeptical regardless of who it claims to be from.
- Don't scan it and then evaluate. Scan it with ScanLikely first so you can see where it actually goes before anything loads.
- If it's claiming to be from your bank, delivery service, or a government agency, go to that organization's official site directly instead of using the QR code.
- For parking tickets specifically, look up the citation number on your city's official site. Real tickets are in the system. If it comes up empty, the ticket is fake.
- If you already paid or entered your information somewhere suspicious, contact your bank immediately and report it as fraud.
How ScanLikely helps
When you scan one of these QR codes with ScanLikely, the destination URL gets analyzed before the site ever opens. Spoofed domains, freshly registered phishing sites, and URLs with suspicious redirect chains all get flagged. The few seconds it takes is worth it.
If you've been hit by one of these, report it to the FBI at ic3.gov and the FTC at ReportFraud.ftc.gov.
Check a QR code before you tap it
ScanLikely reads the code and warns you before it opens anything unsafe: phishing links, fake payment pages, and rogue WiFi networks. Free on iPhone and Android.
