Can a QR code redirect me to a site that steals my login?

A QR code is simply a visual encoding of a URL. Scanning one with your phone is equivalent to clicking a link you cannot read in advance. Malicious QR codes placed on flyers, stickers over legitimate codes, or shared digitally can direct you to convincing phishing sites that mimic bank logins, cryptocurrency exchanges, government portals, or social media platforms. You enter your credentials on the fake page, which are immediately captured. Some sites also attempt to install malware through the browser. The risk is heightened when codes appear in unexpected places — emails, random flyers, or stickers placed on restaurant tables or parking meters over the original code.

'Quishing' works because the QR format hides the destination in plain sight and shifts the interaction to your phone — often outside corporate security filters and onto a small screen where address bars are easy to overlook. Payment contexts are the most exploited: parking meters, restaurant menus, invoice attachments, and charging stations, where scanning-and-paying is already the expected behaviour and a swapped sticker harvests card details in seconds.

Bring the same scepticism to codes that you would to links in emails. In public settings, glance for stickers layered over original signage; on screens, prefer typing the organisation's known address over scanning. If a scanned page asks for logins or payment, stop and reach the service through its official app or website instead.