What the Report Says

German news outlet tagesschau.de, together with public broadcaster rbb (Rundfunk Berlin-Brandenburg), has published a guide on QR code fraud. According to the report, a scam known as 'quishing' is spreading and no longer affects only online users but anyone who scans a QR code in everyday life.

'Quishing' combines 'QR code' and 'phishing'. According to rbb, criminals place manipulated QR codes where people tend to trust them: on parking meters, at EV charging stations, on restaurant tables, in emails and in counterfeit letters from banks and public authorities. Anyone scanning such a code is directed not to the genuine site but to a cloned phishing page that harvests login, banking and credit card data, the report said.

A QR code gives no visual indication of where it leads, the report noted. The fraud is therefore often discovered only after money has been taken.

How the Scam Works

  1. Criminals build a copy of a well-known website, such as a parking app, a charging-station operator or an online banking portal.
  2. They generate a QR code pointing to the fake site and print it as a sticker or as an official-looking letter.
  3. The fake code is placed over the original – on parking meters, charging stations or notices – or sent by letter and email.
  4. Victims scan the code to pay or to respond to a supposed request and enter their data on the fake page.
  5. The perpetrators use the stolen access and payment data to withdraw money, trigger debits or sell the data on.

Warning Signs

QR Code Stuck Over Another

A sticker covering another code, peeling at the edges or sitting crookedly is considered suspicious. Genuine QR codes are usually printed or engraved rather than added later, consumer protection groups say.

Unexpected Request for Data

A page that asks for login details, PIN, TAN or credit card data immediately after scanning points to fraud. Legitimate providers say they do not request such information without prior authentication.

Different or Cryptic URL

Typo domains, unfamiliar endings or cryptic character strings in the scan preview instead of the known brand name are considered a clear sign of fraud.

Time Pressure and Threats

Phrases such as 'final reminder' or 'account will be blocked' are meant to create pressure. Banks and authorities say they do not demand payment via QR code under time pressure.

Rising Case Numbers in Urban Areas

In large cities such as Berlin, QR codes are part of everyday life: parking tickets by app, tickets for public transport and rail, restaurant menus, charging electric cars and e-scooters. According to investigators, this high QR density makes urban areas attractive to criminals. Police and consumer protection agencies report rising case numbers nationwide; documented cases range from Berlin and Brandenburg through Hannover, Frankfurt and Cologne to Dortmund. In one case documented by the Brandenburg Consumer Center, scanned payment links triggered unwanted PayPal payments of over 3,000 euros.

Police and Consumer Advice

  • • Police advise scanning QR codes only when the source is clearly trustworthy, and checking stickers on machines and charging stations for tampering.
  • • Check the URL in the scan preview before opening the page. When in doubt, consumer protection groups recommend typing the address into the browser manually.
  • • Do not enter login, banking or credit card data on a page reached via a QR code.
  • • For banking and payments, use the official app or a manually typed web address rather than a QR code from a letter, email or sticker.
  • • Keep the smartphone operating system up to date. Victims are advised to notify their bank, block the card via the emergency hotline 116 116 and file a report with the police (110).

QRTrust: Checking Destination URLs Before They Open

QRTrust checks the destination URL of a QR code before the page opens. The analysis matches each URL in real time against PhishTank, Google Safe Browsing, a local threat database and an in-house AI model, following up to five redirects to the final destination.

The result shows where a QR code actually leads before any data is entered. The service is GDPR compliant and hosted in Germany.

Check a QR code with QRTrust →

Sources

About QRTrust

QRTrust is Germany's first QR code security platform, developed in Dortmund. AI-powered real-time detection, a local threat database and multi-layered security checks protect citizens, authorities and businesses from quishing attacks. GDPR compliant, hosted in Germany.