Learning to see QR phishing before you scan
QR phishing works because the code is opaque. A link in an email can be hovered over and inspected; a QR code cannot be read by eye at all. Attackers exploit that gap with stickers over legitimate codes, messages that manufacture urgency, and domains that differ from the real thing by a single character. Training is not about memorising a list of bad domains — those change daily. It is about building a reflex: pause, check the context, and compare the code against what you expected.
The first pattern to learn is the overlay. A sticker placed over a real code is the cheapest attack in the book: it takes seconds, needs no technical skill, and inherits the trust of the legitimate sign underneath. Look for crooked edges, a corner of an older code peeking out, a frame that does not match the surrounding signage, or a finish that differs from the rest of the poster. If anything looks added rather than printed, do not scan it — report it to whoever owns the sign.
The second pattern is manufactured urgency. Parcel problems, account suspensions, expiring verifications, and giveaway countdowns all push the same button: act now, think later. Legitimate organisations rarely demand immediate action through a QR code you did not expect. When a code arrives with a deadline, treat the deadline itself as the warning sign, and verify through a separate channel — the organisation's own app, site, or published number — before doing anything the message asks.
The third pattern is the lookalike destination. Read the host from the right, because that is where the registrable domain lives. A TLD swap, a zero for an o, or a subdomain that wears a familiar brand as a costume all rely on the reader stopping halfway through the address. Combine that with the request itself: a free Wi-Fi code that asks for your streaming password, a parking code that leads to an unknown payment domain, a giveaway that asks you to send money first — each one is a context mismatch, and context mismatches catch more attacks than any technical check.
The final habit is the response. If you scanned a suspicious code, do not enter credentials or payment details. If you already did, change the password from a device you trust, enable two-factor authentication, and contact the real organisation. Note where the code was, photograph it if it is safe, and report it so others are protected. A single report can take down a sticker, a domain, or a campaign — and the person who reports it is usually the person who paused long enough to notice.