It looked exactly like the real thing.
By Elizabeth Ndungu | Founder, Ndungu Consulting | Tech Coach for Adults 50+
In Denver, a woman named Cindy Engel scanned a QR code on a parking sign to pay for her spot. It took her to what looked like a normal payment page, so she entered her card details. Moments later, a fraud alert came through.
When she went back and looked closely at the sign, the QR code sticker peeled right off. Someone had stuck a fake code directly on top of the real one. The city’s transportation department later confirmed it does not use QR codes on those parking signs at all. The fake had been sitting there long enough to catch more than one person.
This kind of scam has a name. It is called quishing. And it is turning up in car parks, restaurants, libraries, hospital waiting rooms, and inside letters that look like they came from your bank or your council.
Cindy’s response afterward is the useful part. She now avoids scanning QR codes for parking and pays at the machine directly instead. That one small habit closes the gap the scammer relies on.
What Is a QR Code, and Why Are They Everywhere Now?
A QR code is that square black-and-white pattern you see on menus, signs, and documents. You point your phone camera at it, and it opens a website. No typing needed.
That works well for businesses and has real value for users too. It is why QR codes became so common during the pandemic, when restaurants stopped handing out physical menus. Many businesses kept them afterward. Car parks, museums, GP surgeries, and government offices all use them now.
The problem is that nothing about a QR code tells you where it is going to take you. With a link in an email, you can at least hover over it and read the web address. With a QR code, you scan first and see where you end up afterward.
Criminals noticed this gap.
How Quishing Works
The scam is simple. A criminal prints a fake QR code sticker and places it directly over a real one. On a parking machine, it looks like part of the sign. On a restaurant table, it looks like the menu code. On a letter, it looks like an official payment instruction.
When you scan it, you are taken to a website that looks like the real thing. A car park payment page. A bank login. A government portal. You enter your card number or your password. And that information goes straight to the scammer.
The FBI issued a warning about one version of this in 2025. Criminals were sending unsolicited packages containing QR codes. The packages looked like they had come from a retailer or a delivery company. The codes inside led to phishing websites that collected financial details.
Public warnings like that are one sign of how common these scams have become.
Where Fake QR Codes Are Being Found
Car park payment machines are a frequently reported location. The sticker looks like it belongs there. You are often in a hurry. There is a queue. You scan and pay quickly, which is exactly what the scammer is counting on.
Restaurants are another common target, particularly where there are no printed menus and the QR code is the only option. Public notice boards, transit signs, and event posters have also been targeted.
The version that concerns security professionals most is the one that arrives in the post. A letter appears to come from your bank, your energy provider, or the tax office. It asks you to scan a QR code to update your details or make a payment to avoid a penalty. The letter looks official. The code takes you somewhere it should not.
Here is the important nuance. Some legitimate organizations do use QR codes, so the code itself is not proof of a scam. The warning signs are different: a request you were not expecting, pressure to act quickly, and a page that asks you to enter card details or a password. When those things line up, stop.
How to Stay Safe Without Giving Up QR Codes
You do not need to swear off QR codes. Scanning one at a business you chose to visit, standing in front of you, is generally low risk. The danger is in codes you did not expect: on letters, in emails, or on public signs that could have been tampered with.
One rule covers most of it. If a code leads to a page asking for your card details, bank login, or password, do not enter them there. Open your browser, type the organization’s official web address yourself, and pay or log in from there.
If you receive a letter or email with a QR code asking you to pay a fine or update an account, call the company on a number you find independently. Do not use any contact details printed in the same letter.
To report quishing in the US go to: ic3.gov, or the DOJ Elder Justice Hotline at 1–833–372–8311. In the UK: Action Fraud at 0300 123 2040, or actionfraud.police.uk.
You did not do anything wrong by scanning a QR code. Daily life runs on them now. But one extra step between scanning and handing over your details can greatly reduce your risk.
I write regularly about technology safety and digital literacy for adults over 50. Following me here on Medium is the best way to see the next piece when it comes out.
AI Safety for Beginners: A Simple and Safe Guide for Seniors, a plain-English guide to online safety and avoiding digital scams, is available here:
https://elizabethw2.gumroad.com/l/AIbeginnersafety
For calm, one-on-one technology help with no pressure, no jargon, and no embarrassment, visit ndunguconsulting.com.
About the Author
Elizabeth Ndungu is the founder of Ndungu Consulting, a technology coaching and digital literacy practice that helps adults over 50 build confidence with everyday technology. Computers, phones, AI tools, email, Microsoft Office, online safety, and digital skills in plain English. She provides patient, practical support for people who want to learn without jargon, pressure, or embarrassment.
Sources
FBI Internet Crime Complaint Center, “Unsolicited Packages Containing QR Codes Used to Initiate Fraud Schemes,” 2025: https://www.ic3.gov/PSA/2025/PSA250731
FBI Internet Crime Complaint Center, 2025 Internet Crime Report: https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
9News (KUSA Denver), Steve On Your Side report on the Cherry Creek parking QR code scam, 2025: https://www.9news.com/article/money/consumer/steve-on-your-side/cherry-creek-quishing-scam-stickers-parking-signs
Tags
· · · ·
Leave a Reply