QR code phishing, usually called quishing, is phishing that hides a deceptive or malicious web destination inside a QR code. The victim is pushed to scan the code, and the page or action it opens is designed to steal login details, payment information, or data, or to install malware. The QR code is only the delivery method. The harm comes from where it leads and what it asks you to do once you get there.
What QR code phishing means
Ordinary phishing usually asks you to click a link in an email or text. Quishing swaps that link for a QR code. The code may sit inside an email, a PDF, a Word document, an image, or a text message. It may also be a physical sticker placed over a legitimate code on a sign, meter, or package. The U.S. Postal Inspection Service’s guidance on quishing describes the same core idea: a fraudulent code that sends a person to a fake or harmful destination.
As an Amazon Associate I earn from qualifying purchases.
A QR code is not malicious in itself. It is a machine-readable way to encode a web address, text, or payment instruction, and millions of legitimate codes are used for menus, tickets, and payments every day. The risk comes from the destination and the action it induces. Two codes can look identical on the surface, and only one of them may send you somewhere you should not go.
How a quishing attack unfolds
- A pretext gives you a reason to scan. The message or placement suggests a failed delivery, a problem with an account, suspicious activity that requires a password change, or a payment that must be made now. The urgency is meant to make you act before you check.
- The code hides the destination. You cannot read the address from the code itself. Nothing in the image tells you whether it points to a bank or a credential-harvesting page.
- Scanning moves you to a different device and context. A code in an email is usually scanned with a phone, which opens the link outside the mail app. Microsoft’s threat guidance notes that this shift can make the destination harder to inspect before you open it, and can get in the way of some automated email security checks. A work email scanned on a personal phone is outside the organization’s normal filtering.
- The destination carries out the fraud. A spoofed sign-in page can capture credentials. A payment destination can send money to the wrong party. A malicious site or download can expose data or install malware.
Common forms of quishing
The table below groups the forms described in official warnings. The date and source column tells you how current each description is, since the Federal Trade Commission, the FBI, and the Postal Inspection Service publish at different times.
#1 Best Overall
- 60FPS High Speed USB Camera: High speed USB 2.0 interface to Type C in camera, camera with USB , plug and play ,no need any driver to run. Fast Frame rate for high speed video recording. 60fps@3840X1080P / 60fps@2560X720P 60fps@1600X600P. It enables precise depth detection, 3D reconstruction and simultaneous imaging for enhanced visual capabilities.
- High Resolution Synchronization Dual lens: 4 Megapixels 3840X 1080P 3D stereo synchronous camera module, 180 degree fisheye M12 Mount dual lens Synchronous, HFOV 180 degree, interchangeable. Small outline, mini size 80*16.5mm for embedded application.
- USB2.0 Plug and Play: Dual lens with fast frame 1080P@60fps to capture the quick moving object, works like the human eye, and shots the imaging you want. Ultra HD resolution meets your request for higher quality video still pictures resolution. support UVC compliance for use in OS Windows, Linux, Android, Mac, Support OTG function, can connect Android mobile, pad directly .
- Wide Application: The camera module is ideal for industrial and embedded systems and is suitable for applications such as industrial cameras, advertising displays and device integration. Perfect for Robot vision, Virtual reality, Augmented Reality, biometric Retina analyze, 3D measurement, Intelligent transportation system, People Counting & Tracking, online teaching, live streaming, online meeting or embedded industrial project, etc.
| Form | Typical pretext | What the scan is meant to do | Source and date |
|---|---|---|---|
| Fake delivery or account message | Package could not be delivered; account has a problem; suspicious activity requires a password change | Harvest sign-in credentials on a spoofed page | Federal Trade Commission, consumer alert, December 2023 |
| Substituted parking meter or public payment sticker | Pay for parking or a service by scanning the posted code | Redirect the payer’s money to the scammer | FBI Internet Crime Complaint Center, January 18, 2022 |
| Code in an email attachment or document | Work or personal message asking you to verify, sign, or pay | Move the user to a phishing page outside mail filtering | Federal Trade Commission and Microsoft guidance (as above) |
| Unsolicited package insert | An unexpected package with a QR code, often tied to a brushing scam | Solicit personal or financial data, or prompt a malicious download | FBI public service announcement, July 31, 2025 |
| Targeted spearphishing campaign | Messages aimed at specific organizations | Deliver a malicious payload or steal credentials from targeted entities | FBI FLASH, January 8, 2026 |
Tampered public codes
Physical quishing works by covering a legitimate code with a fraudulent one. The FBI’s 2022 warning described scammers tampering with QR codes on parking meters and other payment points so that the money goes to the wrong account. The attack depends on the code looking official and on people trusting the location. Check whether a sticker appears to sit over another code, whether the payee name matches the place you are paying, and whether the payment page asks for more information than you expect.
Unsolicited packages
The FBI’s July 31, 2025 alert describes QR codes in packages you did not order. The FBI calls this a variation of a brushing scam, in which a sender ships unwanted goods to create a fake review or to make the recipient appear to have ordered them. Here the code is the hook. Scanning it may lead to a request for personal or financial details, or to a download that is malicious. The FBI advises against scanning codes from unknown origins.
Rank #2
- 𝐄𝐚𝐬𝐲 𝐒𝐞𝐭𝐮𝐩 𝐈𝐧𝐝𝐨𝐨𝐫/𝐎𝐮𝐭𝐝𝐨𝐨𝐫 𝐂𝐚𝐦𝐞𝐫𝐚 — 2.5K HD video, vibrant color night vision and IP66, ensuring you never miss a moment, day or night,rainy or sunny. With dual-band 2.4G/5G WiFi & Plug and play setup of the cameras for home security - just download app and scan QR code! No tools needed for tabletop use, mounting screws included for walls
- 𝟐.𝟓𝐊 𝐐𝐇𝐃 & 𝐂𝐨𝐥𝐨𝐫 𝐍𝐢𝐠𝐡𝐭 𝐕𝐢𝐬𝐢𝐨𝐧 — Experience crystal-clear visibility day and night with full-color night vision enhanced by a built-in white light. Perfect as a baby monitor, pet camera, or security camera to monitor your home inside and out
- 𝐒𝐦𝐚𝐫𝐭 𝐀𝐈 𝐃𝐞𝐭𝐞𝐜𝐭𝐢𝐨𝐧 & 𝐀𝐥𝐞𝐫𝐭𝐬 — Stay informed about what matters most with human/motion/sound detection up to 33 feet away. The camera deters intruders with flashing lights and a siren while sending instant alerts to your phone — keeping you one step ahead of any suspicious activity. Call +1 (978) 437-5767 for expert support with setting up and optimizing Vimtag cameras, available Monday to Friday, 9:00 AM - 6:00 PM (ET)
- 𝐄𝐧𝐡𝐚𝐧𝐜𝐞𝐝 𝐓𝐰𝐨-𝐖𝐚𝐲 𝐀𝐮𝐝𝐢𝐨 - Communicate effortlessly with guests or check in on pets using the upgraded two-way audio feature of this indoor camera, allowing you to see, hear, and speak from anywhere
- 𝐓𝐰𝐨 𝐑𝐞𝐜𝐨𝐫𝐝𝐢𝐧𝐠 𝐎𝐩𝐭𝐢𝐨𝐧𝐬 & 𝐑𝐞𝐚𝐥-𝐓𝐢𝐦𝐞 𝐒𝐡𝐚𝐫𝐢𝐧𝐠 - With the mobile app, you can access the baby camera's video anytime, anywhere, view real-time footage, and even share monitoring content with family, keeping you informed about your home dynamics while you're away.Enjoy secure cloud recording with Vimtag Cloud (subscription required) for detecting people, sounds, motion. Alternatively, you can insert a microSD card (sold separately) for local video storage
Targeted campaigns
The FBI’s January 8, 2026 FLASH reported that the North Korean group Kimsuky used malicious QR codes in spearphishing campaigns aimed at U.S. entities. That is a specific, dated warning about one actor. It does not mean every quishing message is state-sponsored. Most quishing you will see is run by ordinary fraud operations that target consumers at scale.
Warning signs before you scan
None of these signs proves a code is malicious on its own, but several together should stop you from scanning.
- You received the code by email or text without expecting it, especially if the message demands immediate action.
- The message threatens a suspended account, a failed delivery, or a penalty unless you act right away.
- The code is in a document, image, or package you did not request.
- A public code has a sticker or label that appears to cover another code.
- The payee, amount, or instructions do not match what you expected for that place or service.
When you do scan, read the full address your phone displays before opening it. Look for misspelled brand names, extra or swapped characters, and domains that resemble but do not match the organization’s official site.
Rank #3
- 2K ULTRA CLEAR & FULL-ROOM COVERAGE - Experience sharper indoor monitoring with the blurams 2K indoor camera. Ideal for bedrooms, living rooms, and pet areas, it delivers full-room visibility with smooth pan-and-tilt 360° coverage. Hands-free control is available through Alexa and Google Assistant for a smarter indoor camera experience.
- SMART AI DETECTION & AUTO PET/HUMAN TRACKING - The A31 indoor pet camera detects motion, people, and sound using built-in AI—no subscription required. When your pet runs or your baby moves, the camera automatically tracks the action and records a 12-second clip so you always know what happened.
- CLEAR NIGHT VISION & TWO-WAY TALK - Check on your pets or little ones day and night. The upgraded color/IR night vision ensures clarity in low light, while two-way audio lets you comfort your dog, talk to your cat, or speak with your family from anywhere.
- FLEXIBLE LOCAL & CLOUD STORAGE - Save every moment your way! Use a memory card (up to 256GB, not included) to record and replay footage 24/7. For full event playback with AI-triggered highlights, blurams cloud storage provides secure, convenient access—subscription required. Flexible options ensure you never miss any important moment.
- EASY SETUP, MULTI-CAMERA VIEW & Wi-Fi 6 SUPPORT - Set up in minutes—just plug in, scan the QR code, and connect. View up to four indoor or pet cameras at the same time in the blurams App and share access with family members. With Wi-Fi 6 support, the camera offers improved connection efficiency and more stable performance in typical indoor environments, especially when multiple devices share the network.
If you already scanned a suspicious code
- Close the page. Do not enter credentials, personal details, or payment information, and do not grant permissions the page requests, such as notifications or access to your camera or contacts.
- Check whether you submitted anything. If you entered a password, go to the account’s official website or app by typing the address yourself, or use a phone number you already trust. Do not use a number or link supplied by the suspicious message.
- Change the password and turn on multifactor authentication. Use a strong, unique password for the affected account and for any other account that used the same one. Enable multifactor authentication where the service offers it.
- Update the phone. Install current operating system and app updates, as the FTC’s consumer guidance recommends.
- Contact your bank or card issuer if you sent money or entered card details, and ask them to review recent transactions.
- Report the fraud. Report consumer scams to the Federal Trade Commission. Report suspicious QR codes in unsolicited packages to the FBI Internet Crime Complaint Center (IC3). Organizations can report phishing to their security team so that it can be blocked for others.
What this guide does not establish
The official warnings used here describe the methods and the pretexts clearly, but they do not publish reliable national figures on how many quishing attempts occur or how many people lose money to them. Treat any percentage or growth claim you see about quishing with caution unless its source, measurement period, and geography are stated. The advice above does not depend on those numbers.
Quick Recap
Best Value
- No Tools, Just Stick It — The secure hook-and-loop fastener mounting sticker makes installation simple. Just peel, stick, and plug in the camera. We've included an extra-long 10 ft micro USB to USB-A cable with cable clips for tidy mounting.
- Upgraded Color Night Vision — Our iconic Color Night Vision just leveled up. Powered by an f1.0 aperture lens and an advanced BSI sensor, it delivers day-like clarity from just a whisper of moonlight or starlight.
- Specialized Design to Reduce Glare — Glare beware. Wyze Window Cam is specially designed to prevent glare on the inside of your window. A bigger mounting sticker removes reflections to give you the clearest footage possible through a window.
- Motion and Sound Detection, No Subscription Needed — Get instant motion alerts pushed straight to your Wyze app the moment something moves. Want fewer false alarms? Add a Security Plan (Cam Plus from $2.99/mo) for smart detection that tells people, pets, vehicles, and packages apart.
- 24/7 Local Recording, No Subscription Needed — Record your full timeline around the clock to a microSD card (up to 512GB, sold separately) and scrub back through every minute anytime in the Wyze app. Want event clips backup in the cloud? Add the optional Security Plan (Cam Plus from $2.99/mo) for 14-day people, pets, vehicles, and packages event video history stored in the cloud.
Rank #4
- 2K Ultra Clear & Full-Room Coverage: Crystal-clear 2K video lets you see every detail — from your baby’s gentle breathing to subtle movements in the room. With smooth 360° pan and tilt, you can see every corner without constantly adjusting the camera.Simply plug in, download the app, scan the QR code, and follow the guided steps, the indoor security cameras is ready in minutes
- Dual-Band Wi-Fi & Reliable Live View: Featuring dual-band 5GHz and 2.4GHz Wi-Fi, this indoor camera wireless keeps your live view smooth and reliable, even in device-heavy homes. No freezing, no sudden dropouts — so you can stay connected whether you're at work, away on a summer trip, or checking in while the kids are home with a sitter
- Smart AI Detection & Auto Motion Tracking：Built-in AI detects movement, people, and sounds—no subscription required. When your baby moves, plays, or stands up, the home cameras indoor automatically tracks and records 12-second clips, keeping you updated on every important moment
- Clear Night Vision & Two-Way Talk: Upgraded color night vision delivers clear images even in low light, while two-way audio lets you interact with your pet in real time or get their attention instantly, keeping you connected even when you're not in the room. With Alexa voice control, this pet camera indoor makes monitoring even more effortless
- Flexible Storage & Privacy Protection: Save footage from your inside cameras for house locally on a 256GB microSD card (sold separately) or securely in the cloud with AES 128-bit encryption. Built-in device encryption adds an extra layer of security, giving you peace of mind whichever storage option you choose
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →
