Published on November 1, 2026 · The mitza.es team
QR codes are on restaurant menus, parking meters, posters, parcels and invoices. They are convenient precisely because there is nothing to type, and that convenience is what scammers exploit. QRishing (also called quishing) means using a QR code to send the victim to a fake website that imitates a real organisation and asks for bank details, passwords or a payment. This summer Spain's National Police and the OCU have stepped up their warnings. This guide sums up what they say and applies it to a business with customers.
What QRishing is and why it works
A QR code is an image that contains a web address (or other data). At a glance you can't tell a legitimate QR code from a fake one, and people scan without thinking. The scammer only needs to place their code where you would expect a trustworthy one, or send you one with an urgent excuse. It works for two reasons: we don't see the address before opening it, and it is used in situations where we are in a hurry (a fine, a parcel that couldn't be delivered, a table where you want to order right now).
The frauds the authorities are detecting
- Fake fines on the windscreen: stickers or papers with a QR code that imitate traffic or parking notices. The OCU warned in July 2026 about these stickers and that the link leads to a cloned website that asks for bank details. Maldita.es has documented cases of fake QR fines in several Spanish municipalities since November 2024.
- Parcel notices and other urgent messages: the National Police insists that the risk rises when the code shows up in situations that make people rush.
- QR codes stuck over real ones in establishments: stickers over the genuine code on a menu, a poster or a payment terminal. Spain's Interior Ministry reports the advice of the Guardia Civil: if a restaurant's payment QR code redirects you to a suspicious website, check directly with the establishment.
What the authorities recommend to people who scan
- Be wary of codes that show up where you didn't expect them or come with an urgent message.
- Turn off automatic opening of links when scanning and check the address before going in.
- Don't enter passwords, bank details or personal information if the website doesn't inspire trust or asks for too many permissions.
- Keep your system and apps up to date, and download apps only from official stores.
- If you have already given away details: call your bank to block the card, report it to the National Police or the Guardia Civil, keep screenshots and the link, and notify INCIBE (Spain's national cybersecurity institute) on 017 (also by WhatsApp on 900 116 117).
Why this is also a problem for your business
If your company uses QR codes, you are a potential setting for the scam: someone can stick their QR code over yours and charge your customers, or send them an email imitating yours with a fake QR code. The scammed customer can't tell the criminal from your brand, and it is your reputation that gets damaged. That is why it pays to protect your codes just as you protect a price sign.
How to use QR codes in your business safely
- Point to your own domain. Use a short, recognisable address on your website (yourwebsite.es/menu) rather than a shortened link from a third party that you don't control.
- Prefer static codes that contain the address directly: they don't depend on a service that could expire, start charging or be tampered with. You can create them with our free QR code generator, which works in your browser and checks that the code can be read.
- Write the address below the QR code. Anyone who feels uneasy can type it in by hand.
- Make the QR code hard to cover: print it directly on the menu or poster and check periodically that there are no stickers on top, especially on tables, counters and shop windows.
- Avoid QR codes on letters and urgent payment notices. Never ask for card details through a code that arrives by email or in the mailbox.
- Keep your brand consistent. A QR code with your logo and colours helps people recognise it, although on its own it doesn't stop someone from forging it.
- Measure the scans. If you add UTM parameters to the link with the UTM builder, you will see how many visits each QR code brings and you will notice if the traffic from one suddenly drops (a sign that it may have been replaced).
What to do if you discover someone has forged your QR code
- Remove the fake code, and take photos before doing so (they serve as evidence).
- Report it to the National Police or the Guardia Civil and notify INCIBE (017).
- Tell your customers through your official channels how to recognise your genuine code.
- Ask the hosting provider and the domain registrar to take down the fake website, and report it as a phishing site.
- Check that your own website and emails are properly protected so they can't be used against you.
Protect the emails you send too
A fake QR code usually arrives with an email that impersonates a company. If your domain doesn't have SPF, DKIM and DMARC configured, it is easier for someone to send messages in your name. You will find the steps in our comparison of Google Workspace and Microsoft 365, and the context on how AI-driven fraud is evolving in the article on AI phishing and deepfakes. If you take payments via Bizum or receive bank transfers, also read about the reverse Bizum scam.
Watch out for the shopping campaign
In periods of heavy online shopping, such as Black Friday, attempts to impersonate stores increase. We have gathered the specific measures in our guide to the Black Friday scams that impersonate your store.
How we can help at Mitza
We help you review where you use QR codes, make sure they point to your domain and measure their performance, and protect your website and email so that nobody can use your brand against your customers. See our IT maintenance service or write to us from the contact page.