QR code scams: what quishing means for a small business and its customers

QR codes are now part of everyday business: menus on tables, parking payments, posters in windows, links in invoices and emails. They are convenient, and criminals have noticed. The scam has a name, "quishing" (QR code phishing), and it affects small businesses in two ways: your staff can be tricked by someone else's code, and your customers can be tricked by a fake version of yours. This post explains what the official sources say, and what is worth doing this week.

How big is the problem?

The National Cyber Security Centre (NCSC) takes a measured view. In its blog post "QR codes: what's the real risk?", published in February 2024 and last updated in March 2025, it says QR code fraud is a real but relatively small share of cyber fraud overall. It adds that most of it happens in open public spaces such as stations and car parks, and that it usually relies on social engineering, meaning the criminal builds trust with a phone call or follow-up message rather than relying on the code alone.

The NCSC also says it is seeing an increase in quishing attacks. On numbers, Which? reported in June 2025 that Action Fraud said £3.5m was lost to reported QR code scams in 2024. So this is not a crisis, but it is growing and it is cheap for criminals to try.

Why a QR code in an email is different

The NCSC gives three reasons criminals put QR codes in phishing emails:

• People have learned to be wary of odd links and shortened web addresses, and a QR code hides the destination.
• Some phishing detection tools do not scan images, so a malicious code can slip past them.
• People often scan with their personal phone, which may not have the protections of a work device.

That last point matters for a small firm. If a member of staff receives an email with a code, scans it on their own phone and types in a work password, your email filtering never had a chance to help.

The scams a business owner is most likely to meet

Action Fraud, as reported by Which?, says fraudulent codes most often appear as stickers placed over the real code on payment machines in car parks. Local councils in Scotland and England have warned about fake parking stickers that led to phishing sites, and some said plainly that they do not use QR codes for parking payments at all.

Online sellers have also been targeted. Which? reports that scammers email QR codes to sellers, sometimes pretending to be HMRC or another UK government body. If you sell through marketplaces, treat any message that asks you to scan a code to "verify your account" or "receive payment" as suspect and go to the platform by typing the address yourself.

What to tell your staff

The NCSC and Which? give consistent advice for individuals, and it works well as a short staff briefing:

• Treat a QR code in an unexpected email with caution. If a supplier or authority really needs something from you, find their official website yourself and go there.
• Use your phone's built-in camera or scanner rather than a third-party scanner app from an app store.
• Look at the web address your phone shows before you open it, and check it matches what you expected.
• Be more careful in open public places such as car parks and stations. Check whether a code has been stuck over another one, and if in doubt, pay another way.
• Be suspicious of any page or follow-up call that asks for more information than seems reasonable.

The NCSC says codes in pubs and restaurants are probably safe to scan, which is reassuring for hospitality, but the same habit of checking the address still applies.

Make reporting easy

The NCSC's phishing guidance is clear that training alone is not enough. It recommends layers: make it hard for attackers to reach your people, help staff spot and report problems, limit the damage if something gets through, and respond quickly. Its advice on reporting is practical:

• Make reporting simple, clear and quick, and tell staff in advance how to do it.
• Do not punish people who fall for a scam. Blame discourages reporting, and early reporting is what limits harm.
• For important requests, such as a change of bank details, verify through a second channel like a phone call to a number you already hold.
• Use multi-factor authentication. As the NCSC puts it, a second factor means an attacker cannot get into an account using just a stolen password.
• Keep software and devices patched. In the NCSC's case study, 14 staff at a financial firm clicked a malicious email, but 13 of the attacks failed to run because devices were up to date.

The NCSC also notes that reporting a scam is free and takes about a minute, and that reports let it investigate and take down scam addresses and websites.

Protecting your own QR codes

If you put codes on menus, posters or table stands, remember that a sticker can be placed over yours. A few low cost habits help:

• Check printed codes regularly, especially in public or unsupervised places, and look for stickers or signs of tampering.
• Print the web address in plain text beside the code, so customers can type it instead of scanning.
• Use a short address on your own domain, so the destination is recognisable when a phone shows it.
• Never ask customers to enter card details through a code that points anywhere other than your own checked payment page.

If you take orders or payments through a code, how the page behind it is built matters. A properly built ordering system on your own domain is easier to recognise and harder to imitate than a generic link. Turtle covers this in its ordering platforms work, and the cloud and security page explains how we approach account and email protection.

A checklist for this week

• Send staff the five-point briefing above, in plain language.
• Agree who they tell, and how, if they scan something odd. Make it clear nobody will be blamed.
• Switch on multi-factor authentication for email, banking and marketplace accounts.
• Walk round and check every QR code you display, and add the written web address.
• Agree a rule that payment detail changes are always confirmed by phone.

None of this needs special software. The aim is simply that a code is never trusted just because it is a code.