{"id":66602,"date":"2026-04-14T14:36:55","date_gmt":"2026-04-14T12:36:55","guid":{"rendered":"https:\/\/www.apfelpatient.de\/?p=66602"},"modified":"2026-04-14T14:39:32","modified_gmt":"2026-04-14T12:39:32","slug":"how-to-detect-and-avoid-qr-code-fraud","status":"publish","type":"post","link":"https:\/\/www.apfelpatient.de\/en\/tipps-tricks\/quishing-qr-code-betrug-erkennen-und-vermeiden","title":{"rendered":"Recognizing Quishing: How to protect yourself from QR code fraud"},"content":{"rendered":"

Manipulated QR codes on parking meters, in letters and on parcel labels \u2013 quishing is the fastest growing fraud scheme in Germany.<\/strong><\/p>\n\n\n\n

QR codes are ubiquitous: in restaurants, at electric vehicle charging stations, on parking meters, in letters and emails. Scammers exploit this very ubiquity. In so-called quishing \u2013 a combination of "QR code" and "phishing" \u2013 manipulated QR codes are used to redirect victims to fake websites and steal login credentials, credit card information, or other sensitive data. The German Federal Office for Information Security (BSI) now classifies quishing as an acute threat, and security experts recorded a fivefold increase in malicious QR codes by the end of 2025. Around 20 percent of all phishing attacks are now based on QR codes.<\/p>\n\n\n\n

Why QR codes are a perfect tool for fraudsters<\/h2>\n\n\n\n

The fundamental problem is simple: the URL contained in a QR code is not visible before scanning. While you can at least check the address of a link in an email before clicking, with a QR code you're trusting that the code leads to the correct destination. Scammers deliberately exploit this blind trust.<\/p>\n\n\n\n

Furthermore, attackers have a technical advantage: Conventional spam filters in email programs recognize links in the text and can block them. QR codes, however, are treated as image files and pass through the filters undetected. The attack shifts from the protected computer to the less secure smartphone \u2013 where corporate firewalls and desktop security software are ineffective.<\/p>\n\n\n\n

The most common Quishing scams<\/h2>\n\n\n\n

Parking meters and EV charging stations:<\/strong> In Kassel, fraudsters affixed fake QR codes to over 300 parking ticket machines \u2013 professional stickers designed to resemble the EasyPark payment service. Anyone scanning the code landed on a deceptively authentic payment page. After a few seconds, the page even redirected to the genuine EasyPark website \u2013 but by then, the credit card data had already been stolen. Similar cases have been reported from Hanover, Frankfurt, Cologne, Dortmund, and Berlin. The same scam works at EV charging stations, where fraudsters cover the original payment codes with stickers.<\/p>\n\n\n\n

Fake bank letters:<\/strong> A particularly brazen scam involves criminals sending letters in the corporate design of savings banks, cooperative banks, or Commerzbank. The letters urge recipients to renew a security procedure such as pushTAN or photoTAN via a QR code. The code leads to a fake login page. The Lower Saxony State Criminal Police Office (LKA Niedersachsen), the Federal Financial Supervisory Authority (BaFin), and several consumer protection agencies have issued official warnings.<\/p>\n\n\n\n

Fake package notifications:<\/strong> Scammers are distributing counterfeit notification cards designed to look like DHL cards in mailboxes. The QR code on the card leads to a phishing website that requests personal or banking information. Important to know: While DHL does use QR codes on genuine notification cards, these cards never request personal or payment information. If you are asked to enter your bank details after scanning the QR code, it is a scam. Always check tracking numbers using the official Post & DHL app or at dhl.de.<\/p>\n\n\n\n

Fake posters on public transport:<\/strong> In D\u00fcsseldorf, fraudsters hung fake posters on buses and trams promising to "win 10,000 Germany tickets." The QR code led to a website for identity theft. People expect to see official advertising on public transport \u2013 and that's exactly what the perpetrators are counting on.<\/p>\n\n\n\n

QR codes in emails:<\/strong> Current campaigns target users of streaming services like Spotify or Disney+. Subject lines read "Problems with your last payment" or "Update required." Instead of a clickable link, the emails contain a QR code that bypasses conventional spam filters.<\/p>\n\n\n\n

Five rules to protect against Quishing<\/h2>\n\n\n\n

First: Check the URL preview.<\/strong> After scanning a QR code, the iPhone camera displays a preview of the target URL before you open it. Take a second and carefully check the displayed address. Look out for typos in the company name, unusual domain extensions, or suspiciously long URLs. If in doubt: don't open it.<\/p>\n\n\n\n

Secondly: Use official apps instead of QR codes.<\/strong> Download payment apps like EasyPark, ADAC, or your charging station operator's app directly from the app store. This way, you completely avoid manipulated QR codes at vending machines. The same logic applies to banking: Always use your bank's official app instead of a QR code from a letter or email.<\/p>\n\n\n\n

Third: Look out for signs of tampering.<\/strong> Check QR codes in public spaces for visible adhesive residue, stickers covering the original code, or edges that indicate they have been covered up. If a vending machine has a display, scan the code from the display rather than a sticker.<\/p>\n\n\n\n

Fourth: Do not enter sensitive data after scanning a QR code.<\/strong> If you are unexpectedly asked to enter login details, PINs, TANs, or credit card information after scanning a QR code, this is a clear warning sign. Reputable providers never request such information without prior authentication.<\/p>\n\n\n\n

Fifth: Be wary of bank letters with QR codes.<\/strong> If you receive a letter from your bank with a QR code, call the official hotline before scanning the code. Legitimate banks generally do not request QR code scanning via mail. Also, check whether you are addressed personally \u2013 fake letters often use generic salutations such as "Dear Account Holder".<\/p>\n\n\n\n

What Quishing has in common with Phishing and Smishing<\/h2>\n\n\n\n

Quishing, phishing<\/a>, and smishing<\/a> are three variations of the same basic strategy: fraudsters impersonate trusted senders and create a sense of urgency to trick victims into revealing sensitive data. The only difference lies in the transmission method \u2013 email, SMS, or QR code.<\/p>\n\n\n\n

The security principles are therefore universal: Don't click or scan anything unexpected. Never enter passwords, PINs, or TANs via a link or QR code that you haven't accessed yourself. Use two-factor authentication for all important accounts \u2013 our article Creating & Managing Secure Passwords<\/a> shows you how to set this up in your passwords app. And when you're using a public network, protect your connection even further \u2013 you can find all the tips in our article Using Public Wi-Fi Securely<\/a>.<\/p>\n\n\n\n

What to do if you've fallen victim to Quishing?<\/h2>\n\n\n\n

If you entered data on a suspicious website after scanning a QR code, act immediately. Block your credit or debit card right away by calling the emergency hotline 116 116. Change any passwords you entered on the site. Contact your bank and inform them about the incident \u2013 unauthorized transactions may still be stopped. File a police report, including via your state's online police station. And check your bank statements for any unfamiliar debits in the following days.<\/p>\n\n\n\n

Scanning QR codes \u2013 but with common sense<\/h2>\n\n\n\n

QR codes are convenient and here to stay. That makes it all the more important to treat them with the same skepticism as links in emails or text messages. The rule of thumb: If you're not expecting a QR code, don't recognize it, or it seems suspicious \u2013 don't scan it. Instead, use official apps, manually type addresses into your browser, and check the URL preview on your iPhone before opening a page. This way, you'll stay safe even in a world full of QR codes. The best products for you: Our Amazon storefront<\/a> offers a wide selection of accessories, including those for HomeKit. (Image: Shutterstock \/ ImageFlow)<\/p>\n\n\n\n