You scan QR codes without thinking about it. The menu at lunch, the parking meter on Market Street, the invoice a vendor emails you, the package notice taped to your shop door. Point, scan, done.
Scammers know that. And they’ve figured out how to turn that quick habit into a way to steal your business’s money and passwords.
It’s called “quishing” — phishing through a QR code — and it’s showing up in Frederick County. Here’s how it works, where to watch for it, and what to tell your team.
How a QR code scam works
A QR code is just a shortcut to a website. You can’t tell where it goes by looking at it, and that’s the whole trick.
A scammer prints a fake QR code and sticks it over a real one — on a parking meter, a restaurant table, a poster in a shop window. Or they email you a fake invoice or delivery notice with a QR code inside. You scan it expecting a menu or a payment page, and instead you land on a convincing copy of a real login page — your bank, Microsoft 365, or QuickBooks. Type in your password and the scammer has it.
Some fake codes skip the login page entirely and try to download a malicious app or file straight to your phone. Either way, one scan is all it takes.
5 places your business is most likely to meet a fake QR code
- Parking meters and pay stations. Stickers placed over the real payment code send you to a fake payment page that collects your card number. If the code on a meter looks like a sticker, or sits slightly crooked over another code, don’t scan it — pay another way.
- Invoices and payment requests. A vendor email arrives with a QR code “for faster payment.” Before anyone in your office scans a payment code, check that the invoice is real: does it match a job you actually ordered, and is the sender’s email address the one you normally deal with?
- Package and delivery notices. A slip on your door or a text saying a package needs a redelivery fee, with a QR code to pay it. Delivery companies don’t ask for fees by QR code on a door hanger. Go to the carrier’s website directly instead.
- Menus and table signs. If your business is a restaurant, cafe, or shop with QR codes on tables or counters, check them regularly. Scammers have been known to swap in fake codes that send your customers to scam sites — and your customers blame you.
- Emails asking you to “scan to verify.” A message claiming your Microsoft 365 account or email will be locked unless you scan a code to verify it. Real companies don’t lock your account behind a QR code in an email. Delete it.
5 rules to share with your team
- Pause before you scan. Ask yourself: do I know who put this code here, and do I trust where it leads?
- Check the code itself. If it’s a sticker on top of a printed sign, a different color, or peeling at the edges, don’t scan it.
- Preview the web address. Most phones show you the link before opening it. If the address looks strange — a misspelled company name, extra words, a random string of characters — close it.
- Never log in after scanning a code. If a QR code takes you to a login page, stop. Go to the site yourself by typing the address or opening the app you already have.
- Slow down when there’s urgency. “Pay now or your account closes” and “scan within 24 hours” are pressure tactics. A real deadline can wait the two minutes it takes to verify.
What if someone already scanned a bad one?
Don’t panic, but act fast. If anyone entered a password or card number, change that password right away from a device you trust, and call your bank if card details were involved. Run a security scan on the phone or computer that was used, and let your IT support know what happened so they can check for anything else. The sooner you report it, the smaller the damage.
Make it part of your routine
QR codes aren’t going away — they’re too convenient. The fix isn’t to stop using them, it’s to treat them like any other link: trust the source, check before you click, and never enter a password on a page you reached by scanning a code in the wild.
Take five minutes at your next team meeting and walk through the five rules above. That’s a small habit that can save your business a very expensive lesson.
And if something feels off — a suspicious invoice, a code that took you somewhere strange, a login page that doesn’t look quite right — call West Main Tech Services at (240) 490-9703. We help Frederick County small businesses sort out exactly these kinds of problems before they turn into real ones.