A QR code on a parking meter promises a quick payment. A code on a poster is meant to take you to more information. In both cases, you only need to take out your phone and point the camera. But those black-and-white squares cannot tell you whether you will reach the city's website, a login for a real service or a page set up by a scammer.
This is exactly the issue highlighted by Neskenuj.me, an awareness project by our BOIT colleague. It shows real examples of QR code scams and demonstrates on your own device what technical details a website can learn when you open it. What does this mean for everyday QR code use?
What is quishing and how does it work?
Quishing is phishing in which an attacker uses a QR code as the route to a scam. Instead of a link in an email, the code may send you to a fake bank website, parking service or company login page. In other cases, it contains payment details that direct money to a scammer's account.
A QR code is simply a way of encoding information. The danger lies in the destination someone hides behind it and what we do after scanning. An attacker can stick their code over the original, put it in a leaflet or replace the code in a shared image. Because we tend to act quickly at a machine, at an event or when paying, we are more likely to trust a page we would ignore in a suspicious email.
Two different scams behind the same little square
QR code containing a link: opens a fraudulent page. It may imitate a familiar service and ask for a card number, password or login details. Simply opening the page does not usually mean you have given the attacker your password or money. The decisive step is usually what comes next: entering details, confirming a payment or downloading and running a file.
Payment QR code: pre-fills a payment in your banking app. There may be no fake website involved at all. If you do not check the recipient and amount before confirming, you may send the money somewhere you did not intend.
What does Neskenuj.me show?
The site has a simple idea: instead of just warning you, it demonstrates the situation on your own device. When you open it, it displays the technical information available to the website and explains why the site operator can see it. You will also find examples of quishing, visitor statistics and an explanation of a so-called fingerprint: a browser and device fingerprint. According to its own description, the project does not use cookies or third-party tracking tools.
What does a website learn when you visit, and what does it learn through the browser?
As soon as a page loads, its server receives information needed for the connection, such as the IP address and data from the browser's request. An IP address can be used to estimate the internet provider and approximate area. It is not the phone's precise location.
A page can obtain additional information through code running in the browser: for example, screen resolution, language, time zone or certain device characteristics. Neskenuj.me clearly displays this information. Combining it can produce a fingerprint that, in certain circumstances, can identify a return visit by a similarly configured browser. It is not your name or a reliable identity card for the device; the result can change, for example, with the browser or its settings.
The distinction matters: this information is not stored in the QR code, and merely pointing your camera at it does not send it to the website. The website obtains it only when you open the link contained in the code. With a payment QR code that merely pre-fills an instruction in a banking app, this step may never happen at all.
How could an attacker use this information?
An IP address and browser characteristics alone do not normally give an attacker access to an account. They can, however, help the attacker assess the visit and adapt the scam. For example, they can see whether people are following their QR code, whether most are using phones and which language or device type they use. They can use this to adjust the fake page or recognise repeat visits. If they create a code specifically for a particular place or group, they can also connect the visit to that context.
The greatest harm usually comes in the next step. Someone enters card details or login credentials on the fake website, or confirms a payment. Technical data helps target the scam; attackers typically gain access to money or an account through what we do on the page.
Two cases from Czechia: parking fees and tornado relief
Prague: fake QR codes on parking meters
In November 2024, Prague's Technical Administration of Roads warned about pink stickers with the EasyPark logo and fake QR codes on some parking meters. The codes led to fraudulent websites where people could hand over sensitive details believing they were paying for parking. The parking operator removed the stickers it found and urged drivers to check the website address before paying. This is typical quishing: the attacker exploits a trusted location and imitates the service people expect to find there. Source: Parking Praha.
South Moravia: an altered code on a tornado relief appeal
After the tornado in 2021, an altered QR code appeared on an appeal by Diecézní charita Brno. A scammer copied the appeal's artwork but inserted a code containing a different bank account. Police detained the suspect and charged them with attempted fraud. This was not a fake login page: the risk was sending a donation to the wrong account. The case is also described on Neskenuj.me, which lists the original sources.
Both examples share the same trick. The QR code borrows credibility from its surroundings: a parking meter or a well-known charitable appeal. Yet either can be imitated by someone with no connection to the original service.
How can you use QR codes more safely?
- Read the full address before opening a link. Pay particular attention to the domain: the actual website name before the first slash. A logo and attractive page design do not prove that it belongs to the right organisation.
- Inspect the place where the code is displayed. An overlaid sticker, different printing or a code stuck over the original are reasons to be alert. A sticker alone does not prove fraud, but it deserves a check.
- When paying or signing in, open the service through your own route. Find the banking app, parking website or organisation's page independently, especially if you are unsure about the address in the QR code.
- Check the details in your banking app before confirming. For payment codes, pay attention to the recipient, account number and amount. Your bank cannot know whom you originally intended to pay.
- If you entered anything on a suspicious page, act immediately. For a payment card or transfer, contact your bank. For a password, change it through the service's genuine website, check active logins and enable multi-factor authentication if available.
The point is not to fear every QR code. Just keep the same caution you would use with a link in an email. The tool Neskenuj.me is a good way to learn this habit through a practical demonstration.
In businesses, similar scams can easily move from public spaces into everyday work: a QR code may appear on an invoice, in an invitation or in event materials. In our cybersecurity training we therefore use specific situations to practise recognising phishing and social engineering. The goal is for people to know what to check before sending details or money.
Back to all articles