QR code phishing, or "quishing," surged 146% across the United States in the first half of 2026, according to a new travel security alert. Fraudsters are placing counterfeit QR code stickers directly over legitimate ones in hotel lobbies, airport terminals, and restaurants in cities like Miami, Dallas, Seattle, and Philadelphia. Scanning one of these tampered codes redirects travelers to spoofed booking or payment pages built to harvest credit card numbers and login credentials.

Discover safer travel with HomeExchange
💡
- 146% increase in QR code phishing ("quishing") cases across the US in the first half of 2026
- Miami, Dallas, Seattle, and Philadelphia identified as the top hotspots
- Scammers stick fake QR codes over real ones in hotels, airports, and restaurants
- Goal: steal credit card numbers, passwords, and banking credentials

What Is "Quishing" and Why It's Spreading So Fast

Quishing, short for QR code phishing, lures smartphone users to malicious websites through fraudulent codes instead of fake links or emails. It exploits a habit most travelers picked up since 2020: scanning a code instead of typing a URL or opening an app. Cases jumped 146% in just six months in 2026, as criminals realized how readily tourists trust a printed square of black-and-white pixels on a wall, table, or kiosk.

Hotels, Airports, and Restaurants: The New Front Lines

Miami, Dallas, Seattle, and Philadelphia have emerged as the four hardest-hit cities, all high-traffic hubs for tourists and business travelers alike. Fraudsters target the exact spots where a QR code is expected and convenient: hotel check-in desks and room-service menus, airport gate displays and parking terminals, restaurant tables meant for viewing the menu. Museum signage, transit kiosks, and municipal parking meters have also turned up compromised in several cities.

A Sticker Is All It Takes

The mechanics behind quishing are strikingly low-tech. Criminals print a counterfeit QR code on an adhesive label and stick it directly over the legitimate one, no hacking required, just a five-second swap. Scanning the fake code redirects the victim to a convincing but fraudulent page: a fake hotel booking portal, a spoofed parking payment form, or a login screen mimicking a real service. Once entered, credit card numbers, passwords, and personal financial details flow straight to the scammer, and some pages silently install spyware on the device.

How Travelers Can Protect Themselves

Security officials recommend a few simple checks before scanning any public QR code: look closely for a sticker layered on top of a printed sign, preview the destination URL in the camera app before tapping through, and never enter banking details or passwords on a page reached via a scanned code. Requesting a paper menu or printed instructions instead, and keeping phone software up to date, are both easy, effective ways to sidestep the trap entirely.

Experience the Authenticity of Travel with HomeExchange

With HomeExchange, you can live that rhythm like a local. Choose from a traditional house, a beachfront villa, or an urban apartment in the heart of a city. Each home offers a unique perspective.

HomeExchange lets you experience true belonging while saving on accommodation costs. Immerse yourself in the local community and enjoy the comforts of a home away from home.

Discover how HomeExchange works