Risk: Elevated

#10TageGegenPhishing: Quishing – When QR Codes Become a Fraud Trap

Category: Phishing · Published: 10/10/2026 · Last updated: 11/10/2026

Summary

What is this about? Current fraud case, reported by Watchlist Internet. See linked source for details.

Who is affected? Consumers in Germany.

How high is the risk? Elevated

Why is this warning issued?

This warning has been included because it is based on a report from Watchlist Internet. It is intended to protect other users from this scam. The assessed risk is elevated.

How the scam works

Criminals look for places or channels where people scan QR codes without suspicion – for example, parking meters, charging stations, letters, e-mails, SMS, posters or flyers.
They stick their own QR codes over genuine ones or add fraudulent codes to messages and notices.
They create a plausible pretext, such as an allegedly blocked bank account, unpaid shipping fees, a lottery or a job offer.
The victim scans the code with their smartphone and is redirected to a fake website that looks deceptively similar to genuine providers.
On the fake site, payment details, login credentials or personal information are entered – or the installation of an app is suggested.
With the obtained data, the perpetrators misuse accounts, cards or identities for further crimes.

How to recognise it

The QR code looks stuck on or covered up – for example, on parking meters, charging stations or in letters that appear official.
A QR code appears in an unexpected situation, such as in an uninvited e-mail, SMS or on a random flyer.
After scanning, a target URL appears that only slightly modifies known names – for example, swapped letters or unusual endings.
The opened page requests sensitive data, such as login credentials, PINs or credit card numbers.
The scan leads to a request to install an app – malware may be hidden behind it.
A message claims pressure (e.g. blocked bank account, outstanding shipping fee) and demands immediate action via a QR code.
Impersonal greeting and time pressure
Link to an external login page

How to protect yourself

Before scanning, check whether the QR code is part of the original print or has been stuck over something else.
Read the target URL that your smartphone displays after scanning carefully – do not open the page immediately.
If possible, use your smartphone's built-in camera instead of an additional QR scanner app from the internet.
Do not enter login credentials, PINs, TANs or credit card details on a QR code page, and do not install any app offered there.
If you have nevertheless entered data: inform your bank immediately, have your card blocked if necessary, change affected passwords (including for services where you use the same password) and enable two-factor authentication.
File a report with the police and report the incident via official consumer protection reporting centres.

What you should never do

Do not simply scan every QR code just because it is stuck somewhere or contained in a message.
Do not pay or enter data under pressure if a message claims a block, dunning or other urgency.
Do not install additional, unknown QR scanner apps – these can contain advertising, subscription traps or unwanted software.
Do not install apps via links or QR codes if their origin is not clearly established.
Do not submit data to unknown pages on suspicion – if in doubt, close the page and go directly to the provider's genuine website in your browser.

Frequently asked questions

Must I pay the demanded payment if a letter or e-mail claims there is an outstanding shipping fee?

No. First of all, do not pay. Check the demand by contacting the alleged company via its official website or phone number yourself – never via the contact details in the suspicious message. Consumer advice centres can support you.

What happens if I have scanned the QR code but did not enter any data?

In that case, no direct damage has usually occurred. Close the opened page immediately anyway, delete the browser history and watch for unusual activity on your device and accounts in the coming days.

I entered bank or credit card details on the page – what now?

Inform your bank immediately, have the card blocked and check the transactions. File a report with the police and change login credentials for online banking and other services. Enable two-factor authentication if possible.

Where did the criminals actually get my address or my data?

This often cannot be determined unambiguously – data leaks, purchased address lists or simply guessed recipients are possible. The fact that a message appears personal does not mean that the senders are actually legitimate.

Are QR codes on charging stations or parking meters still safe to use at all?

QR codes on public devices are generally practical, but you should check the code for signs of being covered over before scanning, read the target URL carefully after scanning and, if in doubt, call up the provider's official app or website directly.

Affected data

Scam type

Phishing

Comments

No comments yet. Registered users can share their experiences.

Related warnings

Original source

Find more information in the original source.

Watchlist Internet ↗

Update history

11/10/2026Description updated
10/10/2026Warning added from an official source