That QR Code Could Be a Counterfeit: How to Outsmart "Quishing" Scams

You pull into a parking spot, and the meter tells you to scan a QR code to pay. You do it without thinking, because that's the whole point of QR codes. They're fast. Ten seconds later you've typed your card number into a payment page and you're walking away, errand underway, none the wiser.

Except sometimes that little black-and-white square doesn't belong to the parking authority at all. It belongs to a criminal who printed a sticker at home and slapped it over the real one.

Welcome to "quishing," short for QR code phishing, and it's having a moment. Industry security reports tracked a spike of nearly 150% in QR code scam incidents across major U.S. cities during the first half of 2026, with Philadelphia among them. That puts this scam in our own backyard: on the parking kiosks, restaurant tables, event flyers, and payment counters that Bucks County residents use every day. And the habit these criminals exploit is nearly universal: a survey by cybersecurity firm NordVPN found that almost three out of four Americans scan QR codes without checking where the link actually leads. Scammers know it, and they're cashing in on it.

Why QR Codes Make Such Effective Bait

When a shady link shows up in an email, you have a fighting chance. You can hover over it, read the address, and notice that something's off. A QR code takes that defense away. The destination is hidden inside the pattern, invisible until after you've scanned it, and by then most people are already tapping through to the page.

Add the fact that QR codes usually appear in places we inherently trust (on a meter installed by the township, a menu stand at a restaurant we like, a flyer for a community event) and you can see why this format is a scammer's dream. The setting does the convincing for them.

The Many Flavors of a Quishing Scam

This scheme shows up in more than one costume. Here are the versions making the rounds right now:

  • The sticker swap. The classic move. A fraudster prints their own QR code on adhesive paper and covers the legitimate one on a parking meter, gas pump, donation box, or table tent. You scan what looks official and land on a payment page built to harvest your card details.

  • The fake ticket on your windshield. A newer twist that surged this spring: realistic-looking parking or traffic violations, complete with an official seal and a QR code to "pay your fine." Some arrive by mail or email dressed up as court notices. The code routes you to a counterfeit government page hungry for your card number, and sometimes your Social Security number too.

  • The switcheroo email. The most sophisticated version. Scammers email a QR code that initially points somewhere harmless, so it sails past spam filters. Once it's sitting safely in your inbox, they redirect that same code to a phishing site. Even careful email systems can miss it.

  • The tax-season trap. The IRS put QR code schemes on its annual Dirty Dozen scam list this year, warning about fake IRS letters and messages that use codes to steer people toward pages collecting Social Security numbers and bank credentials.

The common thread? Every version counts on you scanning first and thinking later.

Red Flags to Check Before You Scan

A few seconds of skepticism defeats nearly all of these schemes:

  • A sticker sitting on top of another sticker. Run a finger over the code on a meter or pump. Raised edges, bubbling, or a code that looks slightly crooked or newer than everything around it are all warning signs.

  • A preview address that looks off. Most phones display the link before opening it. Read that preview. Misspelled agency names, extra words, strange endings, or shortened links that hide the real destination all deserve a hard pass.

  • A code that asks for too much. Paying for parking should never require your Social Security number, your online banking login, or a verification code texted to your phone. The moment a QR code leads to those requests, close the browser.

  • Pressure to act immediately. "Pay this fine within 24 hours" is the same manufactured urgency behind the fake toll texts we covered earlier this summer. Real agencies give you time and offer more than one way to pay.

  • A prompt to download an app. Legitimate QR codes open a website or an official app store listing. A code that tries to install software directly onto your phone is trouble.

Smart Habits That Shut Quishing Down

Build these into your routine, and the scam falls apart:

  1. Preview before you tap. When your camera shows the link, actually read it. If anything looks unfamiliar, don't open it.

  2. Go direct instead. Unsure whether a parking code is real? Type the parking authority's web address yourself or use the official app you've already downloaded.

  3. Never pay a government fine through a QR code that arrived out of the blue. Even when a real agency notice includes a code, you can always skip it and type the agency's official web address yourself. A legitimate fine will show up in their system.

  4. Keep your phone updated. Current software includes protections that flag known malicious sites, and they only work if you install the updates.

  5. Report what you find. Spot a suspicious sticker? Tell the business or parking authority so they can remove it. Received a quishing email or text? Forward texts to 7726 (SPAM) and file a report with the Federal Trade Commission or the FBI's Internet Crime Complaint Center.

  6. Move quickly if you already entered your information. Contact Spirit Financial Credit Union right away so we can help you lock things down, dispute charges, and watch for fraud on your accounts.

How Spirit Financial Credit Union Has Your Back

You shouldn't have to be a cybersecurity analyst to park your car. A few of our tools do the heavy lifting for you:

Scan Smart, Stay Safe

QR codes aren't going anywhere, and honestly, they shouldn't. They're genuinely convenient. The fix isn't avoiding them; it's treating every code like an unmarked door and checking where it leads before you walk through. Preview the link, feel for the sticker, and when in doubt, pay a different way.

Pass this along to the people in your life who scan first and ask questions never. One quick conversation now beats a drained account later.

Questions about a suspicious code, charge, or message? Spirit Financial Credit Union is here to help you protect what you've worked for. Reach out anytime, and let's keep your finances secure together.

For more on spotting scams built for speed, read our blog, "That 'Unpaid Toll' Text Is a Trap: How to Outsmart Toll Smishing Scams."

Greg Quinn