What is quishing? A family guide to QR code phishing

You’re at a restaurant, scanning a QR code to view the menu. Harmless, right? Maybe not. What if that code led to a fake website designed to steal your personal info? That’s the trick behind quishing — a newer, sneaky form of phishing that uses QR codes instead of sketchy emails. And it's something families should know about.

So, what exactly is quishing?

Quishing is short for "QR phishing." It’s when scammers create malicious QR codes that, when scanned, direct you to fraudulent websites or trigger automatic actions like downloading malware or asking for login details. Because QR codes are often trusted and look pretty innocent, it's easy to fall for one that’s been tampered with or placed in a public spot like a restaurant table, parking meter, or event flyer.

Why should families care about quishing?

Be a financially smart family!

Be a financially smart family!

From saving for the future to understanding credit, see how families are thriving with Greenlight.

Try Greenlight today

Kids and teens are digital naturals, often scanning QR codes without thinking twice. Whether it’s for joining a game, accessing a classroom tool, or watching a YouTube video, QR codes are everywhere. That’s why it’s important for families to understand that not all QR codes are created equal.

Quishing scams can:

• Trick your child into entering personal info on a fake login page

• Install harmful apps on their device

• Steal contact details, photos, or even financial data

For parents, this means more than just a tech headache. It could mean identity theft or compromised bank accounts.

What does a quishing scam look like?

Here are a few real-world examples to watch out for:

• The fake parking meter: A QR code on a parking sign leads to a phishing page pretending to be a payment portal.

• The school handout: A QR code on a flyer about a school fundraiser actually links to a shady download.

• The pop-up poster: A scammer places a new QR sticker on top of a real one, redirecting to a fake version of a legitimate site.

5 ways to protect your family from quishing

Now that you know what quishing is and where you or your kids might encounter a shady QR code, use these tips to help protect your devices from this scam. 

1. Preview the link before clicking. Many camera apps will show the URL before opening it. Teach your kids to pause and check for suspicious-looking links.

2. Stick to trusted sources. Only scan codes from known and trusted places — like a teacher's verified handout or your favorite family restaurant’s printed menu.

3. Use security tools. Consider parental control apps or mobile security software that can flag suspicious links before they cause trouble.

4. Talk about online scams. Phishing may sound like a big-kid problem, but kids can be targets, too. Keep the convo going about online safety.

5. Check for tampering. Look closely at any QR code you scan. Is it a sticker placed over something else? That could be a sign it’s fake.

Empower kids with know-how, not fear

The goal isn’t to make your child paranoid about technology. It’s to build awareness. When kids (and adults) understand that cyber threats like quishing exist, they’re better prepared to spot red flags and avoid falling for scams. And, with an app like Greenlight, the #1 family finance and safety app, you can feel better knowing that phone*, purchase, and ID protection is included with the Greenlight Max and Infinity plans. 

It’s a good reminder for us all: Just because it’s a QR code, doesn’t mean it’s safe.

Help kids explore safely. Keep kids safe on the road to independence. Get crash detection, location sharing, and driving reports** with Greenlight. Try Greenlight, one month, risk-free.† 

This blog post is provided "as is" and should not be relied upon as a substitute for professional advice. Some content in this post may have been created using artificial intelligence; however, every blog post is reviewed by at least two human editors.

* Provided by Virginia Surety Company, Inc., cell phone protection is not available to residents of New York.

**Requires mobile data or a WiFi connection, and access to sensory and motion data from cell phone to utilize safety features including family location sharing and driving alerts and reports. Messaging and data rates and other terms may apply.