Phone cameras and dark portals they can open

by Vikram Venkatasubramanian

(3 min read)

It was just a parking spot downtown

You are late to a meeting downtown. You manage to find parking– must be your lucky day! You scan the meter’s QR code, enter your card detailsand you are all set. Convenient, right? Your thirst for convenience is a prime vulnerability moment that may have just been exploited by a cybercriminal. Every scan of a QR code in the wild has the potential to open a portal in to a very dark and seedy alley.

The scam hiding in plain sight

I am not talking about some hypothetical event or fear mongering. I am just reporting the news here. Case in point, in 2024, police in Redondo Beach,California, found fake QR stickers on approximately 150 parking meters. They sent drivers to a website not affiliated with the town or local parking company, asking for location and payment information. The stickers sat beside legitimate payment labels but users who scanned the code, fell victim to a scam in addition to being exposed to the risk of their car being towed since they never paid the actual parking fee! Got scammed and towed would be one heck of an embarrassing story to tell your family and friends.

And it is not just parking meters. QR codes appear on restaurant menus, flyers, posters, delivery notices and emails. Places and sources, you trust or are familiar with. Cambridgeshire Police reported that one victim lost £13,000 after scanning a code on a station parking machine and landing on a phony website.

Isolated incidents, they are not

The Anti-Phishing Working Group reported that cybersecurity company Mimecast detected 635,672 unique malicious QR codes in Q2 2025 and more than 1.7 million across Q4 2024 and Q1 2025. Just to be fair on what I am presenting with this data, these are detected codes, NOT a count of victims or confirmed losses. But they show the scale and prevalence of this type of cybercrime called Quishing (QR code phishing, get it?)

‍

What happens when you scan?

A QR code is simply a way to encode information, for example, a website address. Scanning one does NOT automatically infect your phone. The dangers lie in what happens after that website loads. The website could include one or more types of attacks like: a fake payment page, counterfeit login screen, request for card details, a site infested with malware, malicious ads or a second level scam with instructions to download something. Criminals are counting on you to move quickly and question nothing i.e. target you during a prime vulnerability moment – a phrase that haunts every aspect of our lives these days.

Your 5 step cyber hygiene calisthenics

When you encounter a QR code, evaluate it the same way you would before entering a dark alley:

Pause: Can you use the official app or website of the town or parking company instead?
Inspect: Is the sticker covering another code or out of place?
Verify: When the website loads, preview it and make sure it is indeed the site you intended to reach. Check the entire domain of the website; a familiar logo is NOT proof.
Protect your details: Don’t enter payment or login information just because a page asks.
Report it: Tell the business or parking authority if a code or the website it loads looks suspicious.

All I am advocating for here is vigilance and some cyber hygiene muscle memory. QR codes are useful and the convenience is undeniable. But their ability to reduce friction in a transaction should not outweigh the risk they can mask i.e. the burden is on you to identify the risk-reward ratio. Remember, cyber safety is a risk reduction game and accidents happen when the circumstances for accidents are created. The cybercriminal targets the circumstances that enable these accidents and your job is to raise the cost of targeting these circumstances.