QR Code Scam Risk Calculator

'Quishing' — QR code phishing — has grown as a scam category specifically because it exploits a gap in how people evaluate risk: most of us have learned some caution around clicking suspicious links, but a QR code obscures the destination URL entirely until after you've already scanned it, resetting that caution to zero at exactly the moment it matters most.

The parking meter variant is among the most reported physical-world versions: a scammer prints a sticker matching the visual style of a city's real parking payment QR code and places it directly over the legitimate one. Someone parks, scans what looks like the normal payment code, and enters card details on a fake site designed to look identical to the real payment app or website. Cities including several major US metros have issued public warnings about exactly this pattern, and the giveaway is often physical — a sticker that looks slightly misaligned, a different texture or gloss than the surrounding sign, or simply a QR code somewhere a city's real signage has never had one before.

The unsolicited-message variant works differently: a QR code arrives by text or email — sometimes claiming to be a package delivery issue, a failed payment, or a 'security alert' — precisely because these urgent-sounding contexts discourage the pause that would otherwise prompt someone to check a link carefully. Because QR codes bypass the visual link-preview scrutiny people have learned to apply to typed URLs, this format has become a deliberate way to route around exactly that learned caution.

What makes quishing genuinely different to defend against, compared to a suspicious link in an email, is that the natural moment to catch it — before scanning — offers no visible information at all. The defense has to shift to two other moments instead: evaluating the situation before scanning (does a parking meter usually have a QR code here? did I expect this text?), and reading the link preview your phone shows immediately after scanning, before actually opening the page. Nearly every modern phone camera app shows this preview by default, and it's the single highest-value habit for catching quishing attempts, since it surfaces exactly the information — the actual destination domain — that the QR code was hiding.

None of this requires decoding the image itself in advance; the situational red flags (where it came from, what it's asking you to do) are visible before you ever need to scan anything, which is exactly what this calculator focuses on.