Overview

• The FBI says criminals are sending unsolicited packages that contain QR codes prompting victims to enter personal or financial data or to download malware.
• The bureau urges recipients to avoid scanning codes from unexpected deliveries and to report incidents to the Internet Crime Complaint Center.
• Action Fraud recorded 784 UK quishing reports between April 2024 and April 2025, with nearly £3.5 million lost, or roughly £10,000 per day.
• Investigations show fake QR stickers are frequently placed on parking payment machines, with more than 100 councils reporting targeted car parks.
• Security experts say QR codes hide destination URLs to bypass link warnings, and recent cases include identity theft such as a £7,500 loan taken after a car-park scan.