Hackers have turned innocent QR codes into “quishing” traps, duping millions of Americans out of their money.

Cybercriminals are increasingly exploiting the ubiquity of QR codes in payments, parking, menus and deliveries to carry out a phishing variant known as “quishing” — luring people to scan a malicious code that silently redirects them to fake websites, malware downloads or fraudulent payment portals. In these schemes, scammers often swap or cover legitimate QR codes with their own, or send unsolicited emails, texts or physical packages that prominently feature a QR code and an urgent message to “verify,” “unlock,” or “claim” something. Once scanned, victims may be prompted to enter banking credentials, card numbers or multi‑factor authentication codes, or their phones may be infected with data‑stealing malware, leading to unauthorized withdrawals and purchases that are often difficult or impossible to reverse. Regulators and law‑enforcement agencies in the United States, including the FBI and Federal Trade Commission, have issued specific warnings since 2024–2025 about a sharp rise in fake QR‑code scams and quishing attacks targeting consumers and businesses. The FBI has highlighted a newer twist in which criminals mail unsolicited packages containing QR codes, enticing recipients to scan them as part of a “delivery verification” or product reward, then using the captured information for financial fraud or identity theft. Banks, security firms and university IT departments report that quishing is now a mainstream attack vector, driven by how easy QR codes are to generate and how accustomed people have become to scanning them without scrutiny, which collectively exposes millions of Americans to potential account takeover, drained bank balances and broader data compromise.

✨ AI-generated background, compiled from web sources — not editorial content.

More coverage

• Navigating the Growing Threat of QR Code Scams in 2025 (metrowestlcp.org)
• Hackers Are Exploiting QR Codes to Infiltrate Businesses - Entech (entechus.com)
• QR code scams: A guide to protect yourself - Commerce Bank (commercebank.com)
• Unsolicited Packages Containing QR Codes Used to Initiate Fraud ... (ic3.gov)
• Protecting Yourself from QR Code Scams and Cyber Threats (it.uic.edu)

Explore the topic

• Hacker
• Scam