Post actualizado el día octubre 26, 2026 by DeiviSanzPlay
You’re at a bar, a restaurant, a parking lot. There’s a QR code stuck to the table, the wall or the meter. You scan it without thinking. But what happens if a third party scans your QR code — or worse, if someone swaps the one you were about to scan? The answer is messier than most cybersecurity blogs admit.
QR codes are just links and data compressed into a square image. No encryption, no verification, no warning. That’s the whole problem. Anyone who understands how a QR code works can generate one in 10 seconds and stick it over the original. This is called QR code phishing or «quishing,» and it exploded after 2020 when restaurants replaced paper menus with these codes.
What a Third Party Can Actually Do With Your QR Code
First, let’s separate two very different scenarios that people constantly mix up. Scenario one: someone scans a QR code that belongs to you, like your WhatsApp Web session or your payment code. Scenario two: you scan a QR code that a third party planted to trap you. Both carry risks, but they’re not the same.
If someone scans your personal QR code — the one for Bizum, PayPal, or a WhatsApp device link — they can send you money requests, add themselves as a linked device, or trigger a payment confirmation on your phone if you don’t check what you’re approving. WhatsApp’s own documentation confirms that linking a new device requires you to confirm the action on your primary phone, but many users tap «approve» without reading.
The bigger risk is the reverse. A malicious QR code can take you to a cloned banking site, auto-download an APK on Android, or start a WhatsApp session on the attacker’s computer using your account. That last one is the silent killer: they read your messages, they message your contacts, and they ask for money in your name.
Quishing: The QR Code Scam That Bypasses Email Filters
Security researchers at firms like Check Point and Sophos have been warning for years that QR codes are the perfect vehicle to bypass spam filters. Why? Because the malicious URL isn’t in the email body — it’s inside an image the filter can’t read. You get a PDF or a flyer with a QR code, you scan it with your phone, and suddenly you’re on a phishing page your corporate email never flagged.
In 2024, the FBI issued a public warning about cybercriminals using QR codes to steal credentials and payment data. The trick is brutally simple: they paste a fake QR over a legitimate one at a parking meter, a restaurant table, or a public poster. You pay, the money goes to them, and the real business never sees a cent.
Most Common QR Code Scams Right Now
- Fake parking meters: the sticker replaces the official code and takes you to a payment gateway that looks identical to the real one.
- Restaurant menu swaps: you scan, you land on a page that asks for card details to «confirm your table.»
- WhatsApp Web hijacking: someone sends you a QR code saying «scan this to join a group» and instead links your account to their computer.
- Crypto QR traps: the code contains a wallet address that looks like yours but isn’t — a clipboard-style attack in visual form.
- Fake delivery notifications: «your package is waiting, scan to reschedule» — classic smishing with a QR twist.
Why WhatsApp Web QR Codes Are the Most Sensitive
Linking WhatsApp Web requires scanning a QR code with your phone. That code is a session token. If a third party gets you to scan their QR code — thinking it’s something else — they now have full access to your WhatsApp from their browser. They can read every chat, download your media, and impersonate you.
WhatsApp’s «Linked Devices» section is where you check this. If you see a device you don’t recognize, unlink it immediately. There’s no other way to kick them out. And no, you can’t open WhatsApp Web without scanning a QR code the first time — that’s by design, and it’s the only thing stopping mass account theft.
Anyone who tells you there’s a trick to skip the QR code on WhatsApp Web is either selling you something or trying to steal your session.
How to Protect Yourself From QR Code Attacks
There’s no magic app that makes QR codes safe. The defense is behavioral, and it’s boring, which is why most people ignore it.
- Preview the URL before opening it. Your phone’s camera shows the link before you tap. Read it. If it’s a shortened URL like bit.ly or a domain you don’t recognize, don’t open it.
- Never scan a QR code from an email or PDF asking for credentials. Banks don’t do this. Neither do tax agencies or delivery companies.
- Check the physical sticker. If the QR on a parking meter or menu looks pasted on top of another one, it’s fake. Peel it off or report it.
- Enable two-factor authentication everywhere. Even if someone steals a session, 2FA blocks the login from a new device.
- Audit your linked devices monthly. WhatsApp, Google, Apple, Instagram — all of them have a «where you’re logged in» panel. Use it.
What to Do If You Already Scanned a Malicious QR Code
Don’t panic, but move fast. First, disconnect from the internet if you downloaded anything. Second, change your passwords from a different device — especially email and banking. Third, check your linked devices on every account and remove anything unfamiliar. Fourth, if you entered card data, call your bank and freeze the card.
On Android, go to Settings and check for recently installed apps you don’t recognize. Quishing attacks often push an APK that installs silently. On iPhone, the risk is lower because iOS doesn’t allow sideloading outside the App Store, but phishing pages still work perfectly fine.
The Bottom Line: Treat Every QR Code Like a Stranger’s Link
A QR code is nothing more than a URL wearing a disguise. If a stranger handed you a piece of paper with a random link and said «trust me, scan it,» you’d hesitate. That’s exactly the mental switch you need with QR codes.
The risk of a third party scanning your QR code — or tricking you into scanning theirs — is real, documented, and growing. It’s not paranoia. It’s the same basic hygiene you already apply to suspicious emails, just applied to a format that most people still treat as harmless. Stop treating it that way.
