Fraudsters are increasingly using QR codes: how not to lose payment data

QR codes have become a common tool for contactless payments, logging into digital services, connecting to Wi-Fi, and using electronic tickets. At the same time, the popularity of the technology has attracted the attention of fraudsters: fake QR codes are increasingly being used to steal payment and personal data.

This type of fraud is called quishing – QR phishing. Its essence lies in the fact that after scanning the code, the user is redirected not to the real website of the company or payment service, but to a fake page.

QR phishing attacks are becoming more and more

According to Microsoft, the number of QR phishing attacks in email increased from 7 million in January 2026 to over 18 million in March.

The danger exists not only online. Fraudsters can physically stick fake QR codes over real ones – in particular on parking meters, transport facilities, or in food establishments.

A person scans such a code, considering it official, and then ends up on a phishing resource. If you enter your bank card details, password, or other confidential data on it, they can end up with attackers.

How to protect yourself

Before clicking on a QR code, you should check the website address that your smartphone shows in the preview.

Particular attention should be paid to:

unfamiliar or suspicious domains;

addresses that are similar to the names of well-known companies, but with errors or additional characters;
shortened links that make it impossible to immediately determine the final site;

QR codes in public places that may have another sticker on top of them.

You should be especially careful if, after scanning, the system immediately asks you to enter your bank card details, password, login, or other confidential information.

QR codes are increasingly being used for payments

Despite the risks, the technology continues to develop actively. QR codes are used for contactless payments, authorization, eSIM activation and other digital transactions.

For example, in China they have become one of the usual payment methods through Alipay and WeChat Pay. In India, the UPI payment system processed a record 24.5 billion transactions in August 2026.

In parallel, retailers and the GS1 organization are working on the wider use of two-dimensional codes in trade. They can contain not only the product identifier, but also information about its composition, recall or recycling.

Therefore, with the growing popularity of QR payments, users should check where the code leads before following the link or entering payment details.