How do QR code phishing scams trick people in public places?

The sticker is the entire attack

Most public place quishing needs no hacking at all. Print a sticker with a code pointing to a lookalike payment page, place it over the real code on a meter, charger, or table menu, and collect what motorists and diners type in. The victim pays the scammer, and often still owes the real parking or restaurant bill on top.

Because the fake page is reached in a normal context, at the moment payment is expected, suspicion is low. The page asks for exactly the details the real service would ask for, in the place the victim expected to provide them.

Delivery by message scales the same trick

The same codes arrive by email and text, dressed as delivery failures, account warnings, or shared documents. QR codes in messages have a second advantage for attackers: they move the victim from a protected work computer, where security tools scan links, to a personal phone where fewer checks stand between the code and the credential page.

Security teams now treat codes in messages with the same suspicion as links, but public awareness lags. Many people who would never tap a strange short link will scan a strange code without a thought, because codes still feel like a camera feature rather than a web address.

What the fake pages harvest

Payment card details are the immediate prize in meter and charger scams. In message based quishing, the target is usually a work or email login, captured on a copied sign in page and used within minutes, sometimes with a prompt that also harvests the two factor code in real time.

Small charges may follow days later rather than instantly, and victims often connect them to nothing at all. The parking payment that seemed slightly odd is rarely remembered when a statement arrives, which is part of why the scam reports understate its size.

Checks that take seconds and stop most of it

Peel test the code: a sticker over an original, especially one slightly misaligned, is a stop sign. Preview the destination where your camera app offers it, and read the domain letter by letter. Pay parking and charging through the official app or the machine itself when anything looks off, even if it costs a minute.

Businesses that use codes should inspect their own meters, menus, and posters on a schedule, and print codes under tamper evident covers or directly into signage. A code your customers are meant to trust deserves the same physical security as a card reader.

Reporting and recovery after a scan

If card details went into a page you now doubt, contact the bank first, not the venue: the card can be stopped before the venue has even heard of the problem. Report the sticker location to the operator and local police non emergency lines, because one reported sticker usually means a street of them.

Keep the photo of the code and the page address if your phone recorded them. Reports with the actual destination domain help platforms and registrars take the fake page down, which protects the next hundred people who would have scanned the same sticker.

Keep reading: How does empty box return fraud work in retail?, How does triangulation fraud use real shoppers to hide stolen card orders?, and How do return abuse rings turn generous retail policies into a business? cover the nearby cases in this series.

Frequently asked questions