The QR Code Scam Coming for Your Teen: How “Quishing” Works

Here is the part that surprises most parents: when it comes to who actually reports losing money to scams, it is not grandparents at the top of the list. Year after year, the Federal Trade Commission finds that younger adults report losing money to fraud at a higher rate than older adults do. Older victims lose more per scam, but younger people get caught more often. And the generation right behind them, today’s teenagers, is being raised to do the one thing that makes the newest version of these scams work: scan first, think later.

The scam is called quishing — a mashup of “QR code” and “phishing” — and it had a breakout year. Security analysts who track email threats watched QR-code phishing climb roughly fivefold over the course of 2025, and by July the trend had spilled out of inboxes and into parking lots, restaurants, and concert venues. Both the FTC and the FBI have now put out public warnings. Your teen almost certainly hasn’t seen either of them.

What a QR code actually is (and why that’s the whole trick)

A QR code is not a magic shortcut. It is just a web address — a link — drawn as a grid of squares so a camera can read it instead of a human. That sounds harmless until you say the quiet part out loud: you cannot tell where a QR code goes by looking at it. A link in a text message at least shows you some letters you can squint at. A QR code shows you nothing. By the time you know the destination, your phone has already opened it.

Scammers love this for the same reason magicians love misdirection. The square looks official, it sits somewhere you already trust — a parking sign, a poster, the back of a rideshare seat — and the moment of decision happens after the curtain is already up. Here is the path a scan actually takes once it goes wrong.

Two outcomes do the real damage. The first is a spoofed page: a near-perfect copy of a login screen or a payment form. Your teen types in a password or a card number, the page thanks them, and the credentials are gone. The second is a silent download that drops malware capable of reading texts, including the two-factor codes that are supposed to protect everything else. In the FTC’s January 2025 alert, scanning a single code on a mystery package could do either one.

Where your teen actually meets these codes

This is not an inbox problem they can avoid by ignoring email. Quishing has moved into the physical and social places teens live. A few of the patterns showing up in 2025 and 2026:

The rideshare pickup line. Outside concerts and games in 2026, scammers have worked the chaos of the rideshare zone — a driver waves a teen over, then points to a QR code in the back seat and says “pay here.” The payment skips the app entirely, which means no receipt, no tracked route, and a charge that can be wildly inflated. Both Uber and Lyft have said plainly: you never pay by a QR code shown inside the car.

Tampered stickers in the real world. The cleanest version of this is a fake QR sticker slapped over a real one on a parking meter or lot. People scan, “pay for parking,” and hand a stranger their card — sometimes signing up for recurring charges. The scam spread far enough that the Miami Parking Authority pulled QR payment as an option entirely. Any teen who drives is now in scope.

Giveaways, “free merch,” and drops. A QR code promising free concert merch, a giveaway entry, a sneaker raffle, or free in-game currency is engineered for exactly the audience most likely to want it badly and check it least. The reward is the bait; the scan is the hook.

The package on the doorstep. An unexpected box arrives with a note: scan to see who sent the gift, or to return it. The FBI warned in July 2025 that these codes lead to data-harvesting sites or malware. It is a new wrapper on the old “brushing” scam, and a curious teenager is the perfect person to scan it.

Why teens fall for it when adults might not

It is not that teens are careless. It is that three things stack against them at once. They are the most QR-native group alive — menus, tickets, school sign-in sheets, lunch lines — so scanning is muscle memory, not a decision. They live on phones, where the browser hides almost the entire web address, so the giveaway tell that a parent might catch on a laptop (a weird domain) is mostly invisible. And the codes show up in moments built for impulse: a line that’s moving, a drop that’s “ending soon,” a friend’s repost of a giveaway. Urgency plus a trusted-looking square is the entire formula.

The one habit that defuses almost all of it

You do not need your teen to memorize attack types. You need them to add a single half-second of friction between the scan and the action that follows it. Most phones show a preview of the web address at the top of the screen right after a scan, before the page loads. The whole game is teaching them to read that line.

If your teen already scanned and entered something

The conversation to have this week

You don’t need a lecture. You need ten seconds and a real example. Next time you’re out and you see a QR code on a sign or a table, point at it and ask your teen, “How would you know if that one was fake?” Let them answer. Then show them where the web address appears after a scan, and make the deal out loud: scan if you’re curious, but read the address before you ever type, tap, or pay. That single sentence travels with them into every parking lot and concert line you won’t be standing in.

If you want to go deeper on the broader picture, our guide on how to teach kids about online scams without scaring them covers what to say at each age, and the 2026 internet-safety guide for tweens and teens puts QR safety alongside DMs, AI companions, and privacy. Quishing is also a close cousin of the text-message scams in our USPS smishing guide and the fake-verification trick in the ClickFix CAPTCHA breakdown — same psychology, different delivery.