QR Code Phishing (Quishing), Fake Parking Meter Stickers, and Malicious URLs¶

Scanning a Quick Response (QR) code with your smartphone camera has become an automatic daily habit for paying municipal parking meters, initializing electric vehicle (EV) charging stations, viewing restaurant menus, tracking parcel deliveries, and completing corporate multi-factor authentication (MFA). Threat actors exploit this implicit trust through Quishing (QR Code Phishing): pasting physical vinyl counterfeit QR decals directly over legitimate stickers on public parking kiosks, mailing fake "missed delivery" postcards, or embedding dynamically generated QR images inside corporate PDFs to bypass enterprise email secure gateways.

Because a QR code is simply an optically encoded string of data, capable of holding up to 4,296 alphanumeric characters, your eye cannot inspect the destination URL before pointing your camera at the matrix. Worse, scanning a QR code shifts the attack from your heavily monitored corporate laptop onto your personal smartphone, where mobile browser address bars truncate long subdomains and Adversary-in-the-Middle (AiTM) reverse proxies can capture your credit card, Apple Pay / Google Pay provisioning token, or Microsoft 365 session cookie in seconds. This guide details the immediate containment steps to take within minutes of scanning a malicious QR code, depending on what happened on your screen.

Do this now¶

1. Determine immediately what you did AFTER scanning the QR code. Simply opening a standard web page in Apple Safari or Google Chrome on an up-to-date iPhone or Android phone rarely installs persistent malware by itself. However, if you typed a credit card number, entered an email/Microsoft 365/Google password and 2FA code, scanned the QR code from inside a logged-in app (like Discord, WhatsApp, or Microsoft Authenticator), or installed a .apk app or .mobileconfig profile, you must execute targeted containment right now.
2. If you typed your credit card or debit card into a fake parking meter, toll road, or EV charger website, call the number on the back of your card immediately to cancel the card AND ask the agent to "Revoke all Digital Wallet VTS/MDES Network Tokens." Fake parking and parcel fee pages do not just charge you 3 dollars for parking; they run a background script that enrolls your card into an attacker's Apple Pay, Google Pay, or Samsung Pay smartphone wallet using the SMS one-time passcode you typed on the checkout page. If you only ask your bank for a replacement plastic card without revoking Visa Token Service (VTS) or Mastercard Digital Enablement Service (MDES) digital wallet tokens, the attacker's phone wallet will automatically receive your new card number and keep charging your account.
3. If you logged into a Microsoft 365, Google Workspace, or bank login page after scanning a QR code, use a clean computer to change your password AND click "Sign out of all sessions / Revoke OAuth tokens" immediately. Corporate quishing emails route through Evilginx / Modlishka Adversary-in-the-Middle (AiTM) reverse proxies that steal your post-authentication session cookie even when you use an authenticator app. Follow our MFA phishing and Adversary-in-the-Middle bypass guide and alert your company IT Security / SOC team within five minutes.
4. If you scanned a QR code using the built-in camera scanner INSIDE WhatsApp, Discord, Telegram, Steam, or WeChat, open that app's "Linked Devices" menu and log out all unrecognized sessions immediately. Scanning an attacker's "QR Login" code from inside an authenticated messaging or gaming app grants the attacker an instant WebSocket session clone of your account without needing your password or 2FA code.
5. If the QR code prompted you to download an Android .apk file or install an iOS Configuration Profile (.mobileconfig), put your phone into Airplane Mode and remove the profile or app immediately. Check Settings > General > VPN & Device Management on iOS or Settings > Security > More security settings > Device admin apps on Android, and run a full device audit using our stalkerware, spyware, and keylogger detection on phones guide.
6. If you discovered a physical counterfeit QR sticker on a municipal parking meter, transit kiosk, or EV charger, do not confront anyone loitering nearby. Move to a safe location, notify the parking operator or city enforcement number printed on the painted metal body of the kiosk, and if you face any physical intimidation, call your local emergency number (911 in the United States and Canada, 112 across the European Union, 999 in the United Kingdom, or check our emergency numbers directory).

Malicious QR code (Quishing) incident triage decision tree¶

flowchart TD
    Root["Just Scanned a Suspicious or Malicious QR Code"] --> ActionTaken{"What Happened After You Scanned the QR Code?"}

    ActionTaken -->|"1. Only Opened Webpage: Closed Tab Without Typing Anything or Downloading"| SafeClean["Low Risk: Close browser tab -> Clear site data/cookies for that domain -> Check Downloads folder -> Verify iOS/Android OS is up to date"]

    ActionTaken -->|"2. Entered Credit/Debit Card on Fake Parking Meter, EV Charger, or Parcel Page"| CardComp["1. Call Bank Fraud Dept immediately to lock & replace card<br/>2. CRITICAL: Demand revocation of all Apple Pay / Google Pay Digital Wallet Tokens (VTS/MDES)<br/>3. Check if your car is actually unpaid at the meter to avoid getting towed"]

    ActionTaken -->|"3. Entered Work/Email Password + 2FA Code (Microsoft 365, Google, Okta)"| CredComp["1. Assume AiTM Session Cookie Theft (Evilginx)<br/>2. On a clean PC, change password & click 'Sign Out of All Sessions'<br/>3. Delete rogue MFA devices & inbox forwarding rules<br/>4. Alert Corporate IT SOC immediately"]

    ActionTaken -->|"4. Scanned QR Code Using an In-App Scanner (WhatsApp, Discord, Telegram, Steam)"| SocketHijack["Open App Settings -> 'Linked Devices' / 'Authorized Devices' -> Immediately Terminate All Unknown Web/Desktop Sessions"]

    ActionTaken -->|"5. Installed an App (.apk), iOS Configuration Profile, or Clicked 'Allow' on Prompts"| MalwareCheck["1. Turn ON Airplane Mode immediately<br/>2. iOS: Settings > General > VPN & Device Management -> Delete unknown profile<br/>3. Android: Uninstall rogue APK & revoke Accessibility/Admin permissions"]

Understanding the 5 distinct technical attack vectors behind QR codes¶

A QR code (ISO/IEC 18004 standard) does not only open https:// websites. Depending on the URI scheme encoded inside the black-and-white modules, scanning a code can trigger five completely different actions on your smartphone:

Scenario A: You scanned a fake QR sticker on a parking meter, EV charger, or toll notice and entered payment details¶

Physical QR overlay tampering has surged across cities in North America, Europe, the United Kingdom, and Australia. Because victims are usually standing on a busy sidewalk in a hurry, they rarely notice that a glossy vinyl sticker has been pasted over the painted metal meter face.

Step-by-step financial and vehicle containment¶

1. Lock the compromised card and purge Digital Wallet Provisioning Tokens (VTS / MDES):
2. Open your banking mobile app immediately and toggle Lock / Freeze Card to ON.
3. Call the fraud number on the back of your card and ask for the Digital Wallet / Tokenization Fraud Desk.
4. Why standard card replacement fails: If you entered a 6-digit SMS code or email code on the fake parking page after typing your card number, you inadvertently authorized the attacker to link your card to their Apple Pay, Google Pay, Garmin Pay, or Fitbit Pay account. Ask the bank representative to:
   1. View all Active Digital Wallet / Device Tokens linked to your Primary Account Number (PAN).
   2. Delete/Terminate all unrecognized Apple Pay, Google Pay, and merchant tokens.
   3. Opt out of Visa Account Updater (VAU) / Mastercard Automatic Billing Updater (ABU) for this re-issuance so the new card number is not automatically forwarded to recurring fraudsters.
5. Pay your parking session legitimately right now so your vehicle is not ticketed, booted, or towed:
6. Remember: Because the QR sticker belonged to a criminal and not the city parking authority, your license plate is currently parked unpaid.
7. Never scan any sticker on the machine. Instead, walk to the meter and pay with a physical coin/contactless tap directly on the hardware terminal, or go to the official Apple App Store / Google Play Store, download the verified municipal app (such as ParkMobile, PayByPhone, RingGo, EasyPark, or PayStay), and type the 4-to-6-digit Zone Number painted on the metal pole.
8. Photograph the counterfeit sticker before reporting it:
9. Take a clear photograph of the parking meter or EV charger showing both the counterfeit QR sticker (look for raised adhesive edges, mismatched font sizes, or a sticker covering part of the official logo) and the meter serial/pole number.
10. Call the municipal parking authority or EV charging network (ChargePoint, Electrify America, EVgo, Ionity, Shell Recharge) customer service phone number printed on the kiosk so maintenance crews can scrape off the overlay stickers along the entire street block.

Scenario B: You scanned a QR code in a work email or PDF and entered your Microsoft 365, Google, or Okta login¶

In corporate cybersecurity, QR code phishing is the #1 delivery mechanism for Adversary-in-the-Middle (AiTM) session hijacking. Because most employees read work emails on their desktop monitor and pick up their personal smartphone to scan the QR code on the screen, the login happens over the employee's cellular 5G connection, completely bypassing the corporate laptop's Endpoint Detection and Response (EDR) agent, corporate firewall, and browser phishing extension.

Immediate 15-minute account containment protocol¶

1. Do NOT assume your Authenticator App protected you:
2. Modern quishing pages use Evilginx, Modlishka, or Muraena reverse proxies. When you type your corporate email, password, and 6-digit Authenticator code (or approve an Authenticator Push / number match) on the fake mobile page, the attacker's server relays your credentials to login.microsoftonline.com in real time and captures the resulting ESTSAUTH / ESTSAUTHPERSISTENT session cookie.
3. On a clean computer, rotate your password AND revoke all active session tokens:
4. Microsoft 365 / Entra ID: Go to https://mysignins.microsoft.com/security-info. First, click Sign out everywhere (to invalidate the stolen session cookie). Second, change your password. Third, look carefully at the list of Sign-in methods on that exact page, attackers use automated scripts that register their own rogue Authenticator App or FIDO2 key onto your account within 8 seconds of stealing your cookie. Delete any Authenticator device you do not recognize.
5. Google Workspace / Gmail: Go to https://myaccount.google.com/device-activity, click the unrecognized mobile/Linux session -> Sign out, change your password, and verify 2-Step Verification devices.
6. Check your email inbox for silent "Rule / Forwarding" persistence:
7. Attackers who hijack a corporate mailbox via a QR code immediately create a hidden Inbox Rule in Outlook Web (Settings > Mail > Rules and Forwarding) that routes every incoming email containing words like "Invoice", "Wire", "Payment", "ACH", or "DocuSign" into the RSS Subscriptions or Archive folder while marking it as read. Audit and delete all unknown rules using our email account hacked, forwarding rules, and recovery guide.
8. Notify your corporate IT Help Desk or Security Operations Center (SOC) immediately:
9. Never hide an accidental QR scan at work out of embarrassment. Calling IT within 5 minutes allows an administrator to click "Revoke sessions" and "Require re-register MFA" in Entra ID / Okta before the attacker can launch a Business Email Compromise (BEC) wire fraud attack against your clients.

Scenario C: You scanned a QR code using an In-App Scanner (WhatsApp, Discord, Telegram, Steam)¶

If a friend, gaming server "Verification Bot," or fake giveaway page told you to "Open Discord / WhatsApp / Steam -> Open QR Scanner -> Scan this code to claim a reward or verify your age", you did not visit a website, you just authorized a Remote Desktop / Web Client Login (QRLJacking):

• WhatsApp: Immediately open WhatsApp on your phone -> tap Settings (or the three dots ⋮ on Android) -> tap Linked Devices -> tap every listed Google Chrome (Windows/Linux/Mac) or unknown session -> tap Log Out.
• Discord: Immediately open Discord -> tap Settings -> Devices -> Log Out All Known Devices, and change your Discord password (changing your Discord password automatically invalidates the stolen Authorization token in the attacker's browser).
• Telegram: Open Telegram -> Settings > Devices -> Terminate All Other Sessions.
• Steam: Open the Steam Mobile App -> tap the Shield icon (Steam Guard) -> Gear icon -> Authorized Devices -> Remove access from any unrecognized PC.

Scenario D: You only scanned the QR code and opened the webpage (Didn't type anything)¶

If you pointed your iPhone or Android camera at a suspicious QR code, tapped the yellow URL banner, saw a sketchy webpage load in Safari or Chrome, and immediately closed it without typing any passwords, credit cards, or clicking "Install":

1. Take a deep breath: A zero-click drive-by browser exploit from a street parking sticker is extraordinarily rare. Commercial zero-click mobile browser exploits cost millions of dollars and are reserved by nation-state intelligence agencies for targeted espionage, not mass parking-meter scams.
2. Close the browser tab and purge site storage:
3. iOS (Safari): Close the tab, then open Settings > Apps > Safari > Advanced > Website Data, search for the suspicious domain name, and swipe left to Delete its cookies and cache.
4. Android (Chrome): Tap the padlock / tune icon to the left of the address bar -> Cookies and site data -> Delete (or go to Settings > Privacy and security > Delete browsing data -> Last hour).
5. Check that your browser did not silently enable push notification spam or download a file:
6. In Android Chrome, go to Settings > Site settings > Notifications and verify no strange website was granted permission to send you fake "Virus Detected" push notification pop-ups.
7. Open the Files / Downloads folder on your phone and delete any .apk, .pdf, .ics (calendar spam), or .mobileconfig file that downloaded automatically when the page loaded.
8. Verify no GSM Call Forwarding was triggered (if the QR code opened your Phone Dialer):
9. Open your phone keypad and dial *#21# (checks unconditional call forwarding status). If any number is listed, dial ##002# and press Call to wipe all GSM call-forwarding rules on your carrier line.

Scenario E: Counterfeit Cryptocurrency Hardware Wallet QR Codes and Fake "AirDrop / Claim" Stickers¶

Another rapidly growing Quishing vector targets cryptocurrency owners through physical mailers and tampered packaging:

1. Tampered Ledger / Trezor / Coldcard Packaging Inserts:
2. Fraudsters buy hardware wallets, insert a laminated counterfeit instruction card containing a QR code reading "Scan to run mandatory Firmware Integrity Check or initialize your 24-word recovery seed", shrink-wrap the box, and return it to third-party retail marketplaces.
3. Golden Rule: Legitimate hardware wallets never ask you to type your 12-word or 24-word BIP-39 recovery phrase into a smartphone web page or scan a QR code that asks for your seed words. If you entered your seed phrase after scanning a QR code, your wallet is already monitored by an automated sweeper bot; execute our cryptocurrency wallet drain and seed phrase compromise protocol immediately.
4. WalletConnect (wc:) Malicious DApp Drainer QR Codes:
5. Scanning a wc: QR code from inside MetaMask, Phantom, Rabby, or Trust Wallet connects your Web3 wallet to a third-party decentralized application (DApp). If the site immediately pops up a signature request (Permit2, setApprovalForAll, or increaseAllowance), click Reject and disconnect the WalletConnect session under Settings > Connected Sites / WalletConnect Sessions.

Forensics: How to safely decode and inspect a suspicious QR code image without scanning it with your phone¶

If you received a suspicious PDF or email containing a QR code and want to see where it leads without touching it with your smartphone, use these safe command-line or sandboxed methods on a desktop computer:

# 1. Decode the raw text/URL inside a QR code image offline using 'zbarimg' (Linux/macOS):
# (Does NOT connect to the internet; simply prints the decoded string to your terminal)
zbarimg --raw suspicious_qr_image.png

# 2. Trace all HTTP 301/302 redirect hops without executing JavaScript or loading the page:
curl -sIL --max-redirs 10 "https://suspicious-short-url.example/xyz" | grep -iE "^(HTTP/|location:)"

# 3. Inspect DNS registration age (Quishing domains are almost always <14 days old):
whois suspicious-parking-domain.com | grep -iE "Creation Date|Registrar:"

Reporting physical and digital Quishing attacks to official authorities¶

Reporting a malicious QR code gets both the physical sticker removed by city crews and the underlying phishing domain sinkholed by global browser blocklists (Google Safe Browsing and Microsoft SmartScreen):

1. Report the malicious URL to Google Safe Browsing & Cloudflare Radar: Submit the decoded URL to safebrowsing.google.com/safebrowsing/report_phish/ and radar.cloudflare.com/scan. Once flagged, every iPhone Safari and Android Chrome browser worldwide will display a full-screen red "Deceptive Site Ahead" warning within 15 to 30 minutes whenever the next pedestrian scans that parking meter sticker.
2. File an official cybercrime report:
3. United States: File a report with the FBI Internet Crime Complaint Center (ic3.gov) and the Federal Trade Commission (reportfraud.ftc.gov), and notify your local city parking authority.
4. United Kingdom: Forward quishing emails to report@phishing.gov.uk (National Cyber Security Centre) and report financial loss to Action Fraud (actionfraud.police.uk).
5. European Union, Canada, and Australia: Report to the Canadian Anti-Fraud Centre (antifraudcentre-centreantifraude.ca), Australian Scamwatch (scamwatch.gov.au), or your national computer emergency response team (CERT).

How to inspect any QR code safely BEFORE visiting the URL (Prevention Checklist)¶

You never have to guess where a QR code leads. Follow these five rules every time you encounter a QR code in public or by mail:

• Run your fingernail across physical QR codes on parking meters, EV chargers, and restaurant tables: Legitimate parking kiosk and EV charger QR codes are either silk-screened directly onto the metal faceplate or sealed underneath the clear polycarbonate protective sheet. If your fingernail catches the raised edge of a paper or vinyl sticker stuck on top of the sign, never scan it.
• Read the full URL preview in your native camera app and ignore URL shorteners: Both the built-in iOS Camera app and Android Camera display a small pill banner showing the domain name before opening the browser. If a municipal parking meter or bank notice displays a shortened or generic URL (bit.ly, tinyurl.com, qrco.de, t.co, lnkd.in, or page.link), do not tap it, government agencies and major banks never use third-party link shorteners on payment kiosks.
• Turn OFF "Open Links Automatically" in your phone camera settings: Make sure your camera app requires you to manually read and tap the URL preview banner rather than launching the browser the instant a QR code enters the frame.
• Never scan a QR code that arrives inside an unsolicited physical letter or postcard ("USPS / Royal Mail / Amazon Mystery Package"): Scammers mail physical packages containing a cheap, unordered item (like a plastic ring or phone charger, a "Brushing Scam") accompanied by a card reading "Scan this QR code to see who sent you this gift or process your return." Throw the QR card in the trash.
• Download parking and EV charging apps directly from the App Store / Play Store: Instead of scanning a street QR code, open the official ParkMobile, PayByPhone, RingGo, or ChargePoint app and type the Zone Number printed on the sign.

Frequently asked questions¶