Walk down Chapel Street in Prahran or along the main strip of any shopping centre car park and you’ll spot them everywhere now: little square barcodes stuck to parking meters, café tables and posters, inviting you to point your camera and pay. Most are legitimate. Some aren’t. And the fake ones are a genuinely clever bit of fraud, because they exploit the one habit almost nobody questions anymore, which is scanning first and thinking later.
“Quishing” is just shorthand for QR code phishing, phishing being the general term for scam messages designed to trick you into handing over logins, card details or money. Instead of a dodgy link in an email, the trap is a square barcode. You scan it expecting a parking app or a menu, and instead you land on a page built to look identical to the real thing, except it’s harvesting whatever you type in.
We reckon it’s one of the more underrated scams going around at the moment, mostly because it doesn’t feel like a “scam moment” at all. There’s no urgent phone call, no dodgy grammar in a text. Just a sticker, on a thing that’s already there.
Why QR codes make such a good disguise
A QR code is, at its core, just a picture of a web address. Your phone’s camera reads the pattern of black and white squares and turns it into a link, the same way a scanner at the supermarket turns a barcode into a price. The problem is that humans can’t read a QR code by eye. A link in a text message might show you a slightly wrong domain if you squint. A QR code shows you nothing. You’re trusting the code completely, and trusting whoever stuck it there.
That’s the whole trick. Scammers print their own sticker, often an exact copy of a council or carpark operator’s real design, and stick it directly over the legitimate one. Parking meters are the classic target because paying for parking is already a slightly annoying, slightly rushed task. You’re not in the headspace to scrutinise a webpage, you just want to get back to your car before the inspector walks past.
The Australian Competition and Consumer Commission’s Scamwatch service has flagged fake parking QR codes as a recurring pattern reported by councils and drivers around the country. The fake page usually asks for a card number and expiry, sometimes with a small “processing fee” to make the charge look plausible, and by the time you realise your real parking session never activated, the money’s already gone.
It’s not just car parks anymore
Car parks got the headlines, but we’re seeing the same approach spread into cafés, pubs, gyms and even posters for events. Anywhere a business has normalised “scan this to pay” or “scan this for the menu,” a scammer has a template to copy.
There’s also a second, less obvious version that targets your phone rather than your wallet. Instead of a payment page, the code links to a page that installs a dodgy profile or app, or asks you to log into “your bank” to verify a refund. Same mechanism, different payload. And because QR codes get used for genuinely harmless things too, like restaurant wine lists or gallery exhibit information, our guard tends to be lowest exactly when it should be highest.
The afternoon fix: three checks before you scan
None of this requires new software or a subscription. It’s a habit change, and it takes about the same amount of time as the scam itself.
- Before scanning anything physical (a sticker on a pole, a parking sign, a poster), run a finger over the edge of the code. Scammer stickers are applied over the original and often have a slightly raised edge or a different finish to the surface underneath. If it feels like a sticker on a sticker, it probably is.
- After scanning, don’t type anything in straight away. Look at the web address your phone shows you before opening the page properly. Most phones display a preview of the link first. A council parking page should have a council or recognised payment provider’s domain, not a string of random letters or a slightly misspelled version of a real brand.
- If in doubt, skip the code entirely and use the official app or website you already know, or pay at the machine with a tap-and-go card. Parking apps run by most Australian councils have been around long enough that searching the council’s name plus “parking app” gets you the legitimate one in seconds.
That third point is the one we’d actually argue for as the real fix, not just a backup. Our slightly contrarian take: businesses and councils should stop training customers to scan unknown codes at all, because the convenience saved is tiny compared to the trust it burns. A parking meter that still takes a tap-and-go card, with the QR code as an optional extra rather than the only option, is safer by design. We think more operators should offer that fallback, and we’d rate any car park or venue that still does tap-and-go alongside QR a notch above one that’s gone QR-only.
What happens if you’ve already scanned and paid
If you’ve entered card details on a page you now suspect was fake, the order of operations matters more than the panic does.
Call your bank straight away, using the number on the back of your card or in its official app, not any number from the QR page itself. Ask them to block the card and look at reversing the transaction. Banks deal with this constantly and the faster you call, the better your odds of stopping further charges.
Then report it. ReportCyber, run by the Australian Cyber Security Centre, is the place for the cybercrime report, and Scamwatch takes the broader scam report that feeds into the national picture regulators use to warn other people. Neither will get your money back on its own, but the reports matter; they’re how councils and the ACCC spot clusters of fake stickers in a particular suburb and get them pulled down.
If you typed in any passwords on the fake page, change them immediately, starting with your email, because email is the key that unlocks password resets for everything else. This is exactly the kind of moment where a password manager earns its keep, since reusing the same password across accounts means one scanned code can compromise far more than your parking payment. We’ve gone through the options in detail in our password managers compared 2026 guide if you don’t have one sorted yet.
How this fits the bigger scam picture
Quishing isn’t really a new category of threat, it’s an old trick wearing a new coat. The underlying goal, getting you to a fake page that looks real enough to fool you for thirty seconds, is the same mechanism behind fake delivery texts and bogus “your account has been suspended” emails. If you want the fuller rundown of what’s actually circulating in Australian inboxes and letterboxes right now, we’ve covered the broader landscape in our look at top cybersecurity threats facing Australians in 2026, and the parcel-text version of this same trick in how to spot a fake parcel delivery text.
What makes QR codes worth their own warning is the physical element. A phishing email can be filtered. A sticker on a public pole can’t be, at least not until someone notices and rings the council. That gap, between a scam going live and a human spotting it, is where quishing does its damage, and it’s also exactly why the “feel the edge, check the link, use the app you know” habit matters more than any software fix.
A few places this habit is worth building into
Beyond parking, we’d keep an eye on QR codes at public charging stations (where the code might link to a fake “register your device” page instead of just starting a charge), on posters for events or giveaways, and at pop-up stalls or market stands taking “contactless” payment. None of these are inherently riskier than a café QR menu, but all of them share the same trait: they’re in public, unmonitored, and easy to tamper with for the cost of a sticker and a laminator.
If you manage a small business and use QR codes for payment or menus yourself, it’s worth checking your own codes occasionally for exactly this kind of tampering, and considering a code printed directly onto a laminated sign rather than a separate sticker that someone could peel off and replace. It’s a small thing, but it closes the exact gap scammers are using.
The habit that actually sticks
We don’t think the answer here is scanning fewer QR codes altogether, that ship has sailed and honestly most of them are fine. The answer is treating the moment right after a scan the same way you’d treat a text message asking for your bank details: a quick pause, a glance at the actual web address, and a willingness to just walk to the machine and tap your card if something feels off. It costs you maybe ten seconds. The alternative costs considerably more, and takes a lot longer than an afternoon to sort out.
— Em Castellano, Security Writer, Tech Geek
