QR codes are everywhere now. Restaurant menus. Parking meters. Event posters. Store counters. Packages. Bills. Emails. Signs in windows. You point your phone at the little square, tap the link that pops up and carry on with your day.

And that convenience is exactly what makes QR codes useful to scammers.

The scam even has a name: quishing (phishing using a QR code). Instead of convincing you to click a suspicious link in an email or text, a fraudster gets you to scan a code that sends you somewhere you did not intend to go.

Sometimes the QR code arrives in an email or message. But there is another version that is particularly clever: the scammer simply puts their QR code somewhere you already expect to see one – often by placing a sticker of their QR overtop of a legitimate one.

Why a sticker works so well

That matters because most of us naturally treat the physical world differently from our inbox. We may hesitate before clicking an unfamiliar link in an email, but a QR code printed on a parking meter, restaurant table or poster can feel official simply because of where it is sitting.

Unfortunately, location is not proof.

It has already happened in BC

In June 2026, the City of Vancouver warned that fraudulent QR-code stickers had been placed on parking meters and pay stations. Scanning them could take users to a fake website designed to look like a legitimate parking payment service. The actual parking meter did not have to be hacked. The scammer just had to put a convincing sticker on it.

And that is what makes this fraud worth knowing about.

A QR code is really just a quick way of telling your phone to do something, often to open a website. You cannot look at the black-and-white squares and know where they lead. And once the webpage opens, it may look completely legitimate. A fake site can use familiar logos, colours and wording. It might ask you to pay for parking, sign into an account, enter a credit card, confirm your banking information, or provide other personal details.

Before you scan

Point being: treat a QR code like a link. You would think twice before clicking a random link asking for your credit card or online banking information – and you should treat QR codes the same.

Scanning a square should not get a free pass. Before continuing, look at the website address your phone shows you. Does it make sense? Is the spelling right? Is it actually the organization you expected to visit?

And take a quick look at the QR code itself. Does it look like a sticker was placed over something else? Does the sign look professionally printed but the QR code looks newly added? Is there another way to reach the same service without scanning it?

When money, passwords or personal information are involved, there usually is.

Taking Action

• Be especially cautious with QR codes in public places where anyone could potentially place or replace a sticker.
• Preview the web address before opening it and look carefully at the domain, not just the logo or design of the page.
• If the code leads to a payment or login page and something feels off, stop. Go directly to the organization’s official website or app instead.
• Never enter online banking credentials because a QR code tells you to.
• If a QR code appears to have been covered, altered or added to a sign, meter or payment terminal, let the business or organization know.
• If you entered card or banking information into a suspicious site, contact your financial institution immediately. Change any passwords you may have provided and report suspected fraud to the Canadian Anti-Fraud Centre.

QR codes themselves are not the enemy. They are genuinely useful, and the overwhelming majority you encounter will be completely legitimate. The important part is remembering that anyone can make one. A QR code sitting on an official-looking sign does not automatically make the destination official.

Sometimes the difference between the real payment page and a scam is nothing more sophisticated than a sticker.

—

Staying safe in this digital world is no joke, and awareness matters most – visit StellerVista.com/staying-safe-online learn about this and many other types of fraud.

If something feels off, trust the pause and report all banking concerns to www.stellervista.com/fraud.