QR code (quishing) scam
Fake QR codes stuck on parking meters, menus and posters.
How it works
Scammers paste their QR code over a real one on a parking meter, EV charger or restaurant menu. Scanning it leads to a phishing page that steals your card or installs malware.
Common scenarios to watch for
This scam shows up in several different shapes. Recognise the pattern, not just one message.
Parking-meter overlay
A sticker over the meter's official QR leads to a clone pay page that charges $4 for parking and stores your card for later use.
"Scan to pay — faster than coins! → park-now-au.xyz"
Red flags to spot
- Does the QR sticker look like it was pasted over another?
- Does the URL preview not match the council or parking operator?
- Is the page asking for full card details for a small parking fee?
- Are you being asked to create an account or save your card?
Restaurant menu trojan
The table QR points to a malicious site that prompts you to 'install a menu app' — actually a profile that captures keystrokes.
"Scan for our menu — please tap 'Install profile' so the menu displays correctly."
Red flags to spot
- Is the QR asking you to install an app or profile?
- Does the page look different from the restaurant's usual branding?
- Are permission requests excessive (keyboard access, contacts, location)?
- Did the waiter or staff not mention any app requirement?
EV-charger phishing
A fake QR at a public charger asks for full card and ID to 'authenticate' before charging starts.
"Tap to authorise charging — please verify card + driver licence to unlock."
Red flags to spot
- Is the QR at a charger asking for ID or driver licence?
- Does the payment page not match the charger network's app or site?
- Are you being asked for excessive personal details just to start charging?
- Does the URL look unofficial or use a generic domain?
Red flags
- 🚩QR sticker that looks pasted over another
- 🚩URL preview that doesn't match the business
- 🚩Asked to download an app to pay
- 🚩Page asks for full card + ID details
What to do
- 1Use the official parking or merchant app instead of QR codes.
- 2Always check the URL preview before tapping.
- 3Report tampered QR codes to the business or council.
Who's targeted
- Anyone paying for parking, food or EV charging via QR.
- Tourists less familiar with local merchant URLs.
Why it works
- QR codes hide their destination — you can't 'hover' to check.
- Stickers are cheap to print and easy to place over real ones.
Common variations
Different shapes of the same scam — recognise the pattern.
- 1Sticker over a parking meter QR code.
- 2Fake restaurant menu QR leading to a phishing 'order' page.
- 3EV-charger QR asking for full card + ID details.
If you've already been scammed
- 1Cancel the card and dispute any charges immediately.
- 2Report the tampered QR to the merchant or council.
- 3Run a malware scan if you installed any app from the link.
Frequently asked
Can a QR code install malware?▾
Indirectly — by sending you to a page that pushes a malicious app.
Is using my phone's camera safer than a QR app?▾
Yes — it shows the URL preview before opening.
What URLs are safe to scan?▾
Only ones that match the business's official domain (e.g. paybyphone.com.au).
Questions people ask about this scam
- How does the qr code (quishing) scam work?
- Scammers paste their QR code over a real one on a parking meter, EV charger or restaurant menu. Scanning it leads to a phishing page that steals your card or installs malware.
- What are the warning signs of a qr code (quishing) scam?
- Watch for: QR sticker that looks pasted over another; URL preview that doesn't match the business; Asked to download an app to pay; Page asks for full card + ID details.
- How can I tell if this is a scam?
- Stop and verify independently. Contact the organisation using details you look up yourself, never the ones in the message, and don't act on urgency. You can also paste the message into the ScamShield AI scam checker for a risk assessment — it gives guidance, not a guarantee.
- What should I do if I clicked the link or replied?
- Stop all contact, change the password on any account you logged into and turn on two-factor authentication, and watch your accounts for changes you didn't make. Use the official parking or merchant app instead of QR codes. Always check the URL preview before tapping. Report tampered QR codes to the business or council.
- What should I do if I already sent money?
- Contact your bank immediately and ask about stopping or recalling the payment, keep all evidence, then report the scam. Be wary of anyone who later offers to recover your money for a fee.
- Where should Australians report this scam?
- Report scams to Scamwatch (National Anti-Scam Centre), report cybercrime to ReportCyber, forward scam texts to 7726, and contact IDCARE if identity details were exposed. Contact your bank first if money is involved.
General scam awareness information. ScamShield AI cannot guarantee that every scam will be detected or that a message is legitimate.