CyberThreats.au

Independent cybersecurity education

SearchScammed or hacked?Get help

For you

ScamsIs this a scam?

Types of scams

All scam guides

Practise

Protect yourselfMake my security checklist

Your devices

Everyday situations

Accounts and passwords

Privacy

All protect yourself guides
Cyber threats

Common threats

Newer and specialised threats

All cyber threat guides
Security products

Devices

Accounts and identity

Network and privacy

Backup

All product guides
Free checklists

For you

For work

All free checklists

For work

Small businessSmall business security checklist

Foundations

Payments, suppliers and incidents

All business guides

AI and cloud

All AI and cloud guides
Microsoft 365Microsoft 365 readiness checklist

Identity and access

Email

Teams, SharePoint and OneDrive

Data, devices and admin

All Microsoft 365 guides

Social engineering

QR code phishing: how fake codes work and what official guides say

How QR code scams work, where fake codes appear, and the safer-scanning tips and next steps the eSafety Commissioner's Be Connected and Scamwatch describe.

Last reviewed
Reading time
5 minutes

How to protect against QR code scams: what official guidance lists

You can't tell where a QR code leads by looking at it, so the eSafety Commissioner's Be Connected tips focus on where the code came from and what the page asks for.

  1. Only scan codes from trusted sourcesBe Connected's tip is to "only scan QR codes from trusted sources", and "if you're ever in doubt, play it safe and skip the scan".Be Connected's tips
  2. Watch for a sticker placed over the real codeBe Connected warns that malicious QR codes can be placed over legitimate ones at places such as parking stations or restaurants.Where fake codes appear
  3. Sign in through the official app or a typed address, not the scanned pageIf a scanned page asks for login details, Be Connected's tip is to enter the organisation's URL in a trusted browser or use its official app.Signing in safely
  4. Be wary of requests for card details or other extrasBe Connected says not to provide personal or financial details unless it's a trusted website, and to be cautious of unnecessary requests such as saving card details.Unnecessary requests
  5. Keep your phone's software up to dateBe Connected lists keeping the smartphone's operating system up to date among its tips.How to update an iPhone
  6. Entered card details? Contact your bank right awayScamwatch's steps are to ask your bank or card provider to stop any transactions, contact IDCARE on 1800 595 160, then report the scam to Scamwatch.Scamwatch's steps

Based on the eSafety Commissioner's Be Connected guide to scanning QR codes and Scamwatch's phishing and what-to-do pages, checked October 2026.

Key points

  • Be Connected explains that QR codes store data, such as a web address, so a code can lead to a fake website like any other link.
  • A fake page reached through a QR code works like any phishing page: it may ask for card details, a password or personal information.
  • Be Connected warns that malicious QR codes can be placed over legitimate ones at places such as parking stations or restaurants.

QR code scams use a fake or altered QR code to open a fake website that asks for card details, a password or personal information. QR codes appear on menus, parking meters, posters, letters and invoices. The eSafety Commissioner’s Be Connected program explains that QR codes “simply store data”, which a phone camera translates into something such as a web address, a phone number or text, shown as a link or banner to tap. Because it’s hard to tell where a code leads before scanning it, QR codes can be used for phishing. These QR code scams are sometimes called “quishing”. This guide explains how they work, where fake codes appear, the safer-scanning tips Be Connected describes, and what Scamwatch says to do if you’ve entered details.

How QR code phishing works

If a code has been made or altered by a scammer, it can open a fake website. Scamwatch describes phishing as attempts “to deceive you into giving out your personal information”, and says scammers “even create fake websites that look like the real thing but they’re not”. Phishing, smishing and vishing explained covers the same tricks by email, text and phone. A fake page reached through a QR code might ask for:

  • card details, for example for a payment
  • a username and password on a look-alike sign-in page
  • personal information.

Where fake codes appear

Be Connected warns that “some malicious QR codes can be placed over legitimate ones at places such as parking stations or restaurants”.

A fictional example

Sam parks at a car park and sees a QR code sticker on the meter: “Scan to pay”. The page that opens, pay-parking.example, asks for card details and offers to save them. Be Connected’s tips describe both the malicious-sticker risk and unnecessary requests like saving card details.

How to scan QR codes more safely: Be Connected’s tips

Be Connected’s tips for using QR codes safely include:

  • “Only scan QR codes from trusted sources”, and “if you’re ever in doubt, play it safe and skip the scan”.
  • “Don’t provide personal or financial details unless it’s a trusted website.”
  • If a website asks for login details, to “sign in by entering the organisation’s URL in a trusted browser or visit their official app”.
  • “Read any associated permissions carefully.”
  • Being cautious of “any unnecessary requests”, such as saving credit card details or signing up for marketing.
  • Keeping the smartphone’s operating system software up to date. See how to turn on automatic updates on an iPhone or how to install updates on an Android phone.

Scamwatch’s phishing guidance also describes “accessing the organisations’ secure, authenticated portal or app by never using a link”. For more ways to think through a suspicious request, see is this a scam?.

If you entered details after scanning

Scamwatch’s guidance on what to do if you’ve been scammed includes:

  1. Contacting your bank or card provider right away, reporting the scam and asking them to stop any transactions.
  2. Contacting IDCARE (1800 595 160) for a free plan to limit the damage.
  3. Reporting the scam to Scamwatch once your details are secured.

Scamwatch’s phishing page also lists changing passwords on “all your devices and online accounts like banking, email, government and shopping”. If an account has been taken over, see what to do if an account has been hacked, and for a fuller list see Scammed or clicked a suspicious link? First steps.

Where to report

Scamwatch takes scam reports at scamwatch.gov.au/report-a-scam. Where to report scams and cybercrime in Australia lists other services, including IDCARE.

Common questions

How do QR code scams work?

A QR code can hold a web address, so a code made or altered by a scammer can open a fake website like any other link. Be Connected explains that QR codes “simply store data”, and because it’s hard to tell where a code leads before scanning it, they can be used for phishing. The fake page may ask for card details, a password or personal information. See how QR code phishing works.

Is it safe to scan QR codes?

This guide can’t say whether a particular code is safe. Be Connected’s tips are to “only scan QR codes from trusted sources”, and “if you’re ever in doubt, play it safe and skip the scan”. It also says not to provide personal or financial details unless it’s a trusted website, and to keep the phone’s operating system up to date. See Be Connected’s tips.

How can I tell if a QR code is fake?

It’s hard to tell where a code leads just by looking at it. Be Connected warns that malicious codes can be placed over legitimate ones, for example at parking stations or restaurants, and lists being cautious of “any unnecessary requests”, such as saving card details. If a page asks for login details, its tip is to sign in through the organisation’s own web address or official app instead. See where fake codes appear.

Can a QR code on a parking meter be a scam?

Yes. Be Connected warns that “some malicious QR codes can be placed over legitimate ones at places such as parking stations or restaurants”. A page that asks for card details and offers to save them matches the unnecessary requests Be Connected describes being cautious of. See a fictional example for how this can look.

What is quishing?

“Quishing” is a common name for phishing that uses QR codes; it isn’t an official term. Be Connected explains that a QR code can hold a web address, so a code made or altered by a scammer can open a fake website. Scamwatch says scammers “even create fake websites that look like the real thing but they’re not”. See phishing, smishing and vishing explained.

What do I do if I scanned a scam QR code and entered my card details?

Scamwatch’s steps are to contact your bank or card provider right away and ask them to stop any transactions, contact IDCARE (1800 595 160) for a free plan to limit the damage, and report the scam to Scamwatch once your details are secured. Its phishing page also lists changing passwords on banking, email, government and shopping accounts. See if you entered details after scanning.

Practise

Scenario 5 in the Phishing Awareness Quiz is a fictional QR code example.

Sources

QR codesquishingphishingparkingpayments