Not legal advice: This article covers marketing practice and general security awareness, not a security audit. If your business collects payments or sensitive data through a QR code, involve a qualified security professional in how you deploy and monitor it.
Search "are QR codes still relevant" and marketing blogs answer with the same handful of recycled numbers, usually without a link to where any of them came from. Search "is QR phishing real" and security blogs answer with an equally recycled "quishing is exploding" line — often citing a stat that turns out to contradict itself inside its own source. Both conversations happen to be about the same square black-and-white pattern, and neither one usually checks its own citations.
We went and checked them: the one forecast most of the "QR codes are back" growth claims trace to, the largest disclosed 2026 marketer-and-consumer survey we could find, a named security vendor's own detection numbers, two separate FBI fraud alerts, and a real QR-code scam that made Israeli headlines. What we found: the growth is real but rests on a single 2022 forecast, not fresh measurement; a genuine hype-versus-measurement gap sits inside the best marketer survey available; the phishing threat is real and independently documented — but the specific percentage everyone quotes for it is self-contradicting in its own most-cited source.
Key takeaways
- eMarketer's own 2022 forecast — the source behind most "QR codes are back" growth claims — projected US smartphone QR-scanner users rising from 83.4 million (2022) to 99.5 million (2025). It's a real, named forecast, but a forecast made in February 2022, not a fresh measurement of what actually happened.
- The largest disclosed 2026 QR survey we found (Uniqode: 524 U.S. marketers, 1,000 consumers, 188+ million scans across 796,000 codes) shows a real hype-measurement gap: 98% of marketers report a positive impact and 60% plan to increase usage, but only 12% actually connect scans to revenue, and a third report fragmented tracking.
- QR phishing ("quishing") is real and independently documented: Barracuda's own named researchers detected more than 500,000 phishing emails with QR codes hidden inside PDF attachments in a single quarter of 2024, impersonating Microsoft, DocuSign and Adobe. The FBI has issued two separate PSAs on QR fraud (tampered codes in 2022, mailed scam packages in 2025).
- The specific quishing statistic that circulates most — "QR codes' share of phishing rose from 12.4% to 10.8% to 12%" across 2023–2025 — is self-contradicting in its own source, which cites an unnamed "Linkcpa report" that doesn't correspond to any known security vendor. The FBI's own July 2025 alert explicitly calls the QR-package scam "not as widespread as other fraud schemes."
- A QR-code scam that recirculated in Israeli media — a tampered Herzliya municipality parking-ticket QR code leading to a phishing site — was, by the municipality's own account to Israeli press, a single isolated incident from 2022, not a new wave, and the National Cyber Directorate's practical advice was simply to verify the destination independently before paying.
- Static and dynamic QR codes aren't a cosmetic choice: a static code's destination is frozen the instant it's printed with zero visibility into who scanned it; a dynamic code can be repointed and measured after printing — the same property that makes a legitimate code auditable is what a tampering attack exploits when a business can't check it.
How many people are actually scanning QR codes in 2026?
QR codes are a much older technology than their current marketing buzz suggests — Denso Wave invented them in Japan in 1994 for tracking automotive parts — and for most of the 2000s and 2010s, using one on a phone meant downloading a separate scanner app, which most people never bothered to do. That changed at the operating-system level: Apple built QR scanning directly into the iPhone's Camera app with iOS 11 in September 2017, and Google followed by building it into the default camera or Google Lens on Android 9 ("Pie") in August 2018. The 2020 pandemic then gave the now-unlocked capability an obvious first mainstream use case — the contactless restaurant menu — that didn't require explaining what a QR code even was.
The clearest disclosed number for what that adds up to today comes from a single, named forecast: eMarketer's "QR Codes Forecast and Trends 2022" report, published in February 2022, which projected the number of US smartphone users scanning a QR code rising from 83.4 million in 2022 to 99.5 million in 2025. It's worth being precise about what that number is — a forecast made four years before this article, not a freshly measured count of what actually happened — but it's a real, attributed figure, not an anonymous "studies show."
99.5 million
US smartphone users eMarketer projected would scan a QR code in 2025 — up from 83.4 million in 2022 — in a forecast the research firm published back in February 2022.
Source: eMarketer, "QR Codes Forecast and Trends 2022" (Peter Adrian, Feb 11, 2022)
What do US marketers actually report about QR codes, and where does the confidence run out?
The largest disclosed QR survey we could find for 2026 is Uniqode's "State of QR Codes" report, and its methodology is unusually specific for this category: 524 U.S. marketers surveyed across retail, hospitality, CPG, financial services, healthcare and technology, 1,000 consumers surveyed nationally in October 2025, and 188 million-plus real scans analyzed across 796,000 QR codes generated on its own platform from January through December 2025 — a disclosed sample size and date range, which is more than most QR statistics on the internet can say for themselves.
What that survey shows is real enthusiasm sitting on top of a real measurement gap. Almost every marketer surveyed reports a positive impact and most plan to lean in further — but the number who can actually tie a scan to revenue drops sharply, and a third describe their own tracking as fragmented across tools. That's not a reason to distrust QR codes as a channel; it's a reason to be skeptical of any specific ROI number attached to them, since even marketers actively using QR codes mostly aren't the ones measuring it end to end.
The gap between "98% say it works" and "12% can prove it with revenue" is the single most useful number in the whole report — it's the honest state of QR measurement industry-wide, not a flaw specific to any one tool.
Where is QR code scanning actually growing fastest right now?
Bitly, one of the platforms with genuine scan volume behind it, published its own "State of QR Code Scans" analysis in March 2026, attributed to a named product executive rather than an anonymous roundup. Its regional breakdown shows Europe and Latin America growing scan volume fastest year over year, with North America — the market most "QR codes are back" content is written for — showing the smallest gain of the regions it tracked.
The report also makes a specific, checkable claim worth repeating on its own: in most of the markets it tracked, the number of QR codes being created grew far slower than the number of times they were actually scanned — meaning the codes already in circulation are simply getting used more, not that businesses are printing dramatically more of them. Bitly does not publish a detailed third-party-audited methodology behind these regional figures, so we're presenting them as one real platform's disclosed numbers, not an independently verified industry census.
Do consumers actually trust QR codes, and is that trust growing?
Uniqode's consumer half of the same survey (1,000 US consumers, October 2025) points the same direction as the marketer data: real, and still climbing. Seventy-one percent said QR codes are genuinely helpful in their daily lives, and three-quarters said their main reason for scanning is simply to get information faster than typing a URL would. Fifty-eight percent said they're confident a QR code is safe to scan, and just over a quarter said they trust QR codes more than they did the previous year — a real year-over-year increase in trust, from consumers who are, by the same survey, also increasingly willing to hand over data through one: 83% said they'd share personal information via a QR-code-linked form if the exchange felt worthwhile.
Read next to the security data in the following section, that's the actual tension worth paying attention to — not "are QR codes safe," but the fact that consumer trust in them is rising at almost exactly the same moment a real, independently documented attack category built specifically around that trust is also rising.
Is the QR phishing ("quishing") threat real, or mostly recycled fear?
Both things are true at once, which is rarer than either the security-blog or the debunking version of this story usually admits. What's independently documented and attributed to a named source: Barracuda's own threat researchers reported detecting more than half a million phishing emails with QR codes embedded inside PDF attachments — a tactic built to slip past filters that scan email text and links, not images inside a document — over roughly three months in mid-to-late 2024, most of them impersonating a small handful of trusted brands. The FBI's Internet Crime Complaint Center has published two separate, specifically worded PSAs on QR fraud: one in January 2022 about criminals physically or digitally tampering with legitimate QR codes to redirect victims to fake login or payment pages, and one in July 2025 about a scam that mails unsolicited packages containing a QR code designed to steal financial information. Academically, a 2025 preprint from American University of Beirut researchers Fouad Trad and Ali Chehab built a machine-learning classifier that tries to flag a malicious QR code from its pixel pattern alone, without even decoding it — reaching an AUC around 0.91 in testing. The fact that this is a live, unsolved research problem in 2025–2026, not something spam filters already handle reliably, is itself a real data point.
What doesn't hold up under checking is the specific number most often quoted for how big this all is. The widest-circulated version claims QR codes' share of all phishing attacks rose from 12.4% in 2023 to 10.8% in 2024 back up to 12% in 2025 — a figure that goes up, down, then up again, attributed in its own source to an unnamed "Linkcpa report" that doesn't match any publicly known security vendor. And the FBI's own July 2025 alert is explicit that the mailed-package version of the scam is "not as widespread as other fraud schemes" — a real, growing, worth-taking-seriously threat, described by the agency tracking it as still a minor share of total fraud, not the epidemic the recycled percentage implies.
What's actually claimed vs. what checks out on quishing statistics?
| What a widely-shared quishing roundup claims | What we found checking it |
|---|---|
| QR codes' share of phishing rose steadily: 12.4% (2023) → 10.8% (2024) → 12% (2025) | The same roundup's own numbers go up, then down, then back up — a self-contradicting sequence, not a steady rise — and it cites an unnamed "Linkcpa report" as the source, a name that doesn't match any publicly known security vendor. |
| "QR phishing incidents grew fivefold in 2025 — from 46,000 to 250,000 emails" | The same 5x jump and the same two email counts circulate across several aggregator sites, attributed to a named vendor in some copies and left unattributed in others, without a link back to an original disclosed report from either. |
| What's actually independently, specifically disclosed | Barracuda's own named researchers reported detecting 500,000+ QR-phishing emails hidden in PDFs in one quarter of 2024, with a brand-impersonation breakdown they published themselves — the chart above. |
None of this means quishing is fake — it's a real, FBI-documented, academically-studied threat. What's manufactured is the specific headline percentage everyone quotes for how big it's gotten, which turns out to contradict itself in its own most-cited source.
What actually happened with the Herzliya parking-ticket QR code?
A screenshot that recirculated on Israeli social media and WhatsApp groups showed what looked like a Herzliya municipality parking ticket with a QR code that, instead of opening the municipality's real payment page, led to a phishing site designed to harvest credit card details. Israeli outlets reporting on it (Mako, Be106 and Herzliya Today among them) traced it to the National Cyber Directorate (מערך הסייבר הלאומי), which confirmed the tampering was real — someone had taken an old, legitimate parking ticket and physically or digitally swapped its QR code for a malicious one — but Herzliya's municipality told Israeli press that this traced to a single isolated incident from 2022, not a new or ongoing wave, and that it had filed a police complaint.
The National Cyber Directorate's actual guidance around the case is the more durable takeaway than the scare headline: don't act on a QR code on an official-looking document by scanning and paying straight through it — check the destination independently through the organization's own site or app, use a link-checking tool if one is available, and report anything suspicious to the Directorate's 119 hotline. That's a close cousin of the FBI's own January 2022 PSA on exactly the same tampering pattern — the Bureau's alert specifically names a sticker placed over a legitimate code as the method, the same swap-the-code approach behind the Herzliya ticket.
Static vs. dynamic QR codes — what's the actual difference?
This is the one QR-marketing distinction that isn't hype in either direction, and it's the same distinction that separates an auditable code from a tampering target. A static QR code encodes its destination directly in the pattern itself: once it's printed, that destination is frozen for good, and there's no way to know afterward who scanned it or how many times. A dynamic QR code instead encodes a short redirect link — the printed pattern never changes, but the business controlling it can repoint that link to a new destination at any time and see scan activity after the fact.
| Static QR code | Dynamic QR code |
|---|---|
| Destination is baked into the code — frozen the moment it's printed | Destination is a short redirect link you can repoint anytime, even after printing |
| No visibility into who scanned it, or how many times | Scan counts (and often timing and device data) visible after the fact |
| A long destination URL makes for a denser, harder-to-scan pattern | A short redirect link keeps the printed pattern simpler and easier to scan |
| Free, no account needed to generate one | Needs an account to manage the redirect (a free oToK account covers this) |
oToK's free QR generator (otok.io/tools/qr-generator) produces a static code with no signup — colors, shapes and a logo, downloaded as a PNG or SVG, nothing stored in the cloud. A free oToK account unlocks the dynamic version of the same code: the printed pattern stays identical, but the destination and scan count stay editable after it's already out in the world.
So how should a business actually use QR codes in 2026, without the hype or the risk?
- 1Run the scannability basics before you print anything, not after: dark code on a light background at 4:1 contrast or better, a centered logo covering at most 20–25% of the code, a quiet zone of at least 4 modules around it, printed at 2×2 cm or larger, and a real scan test on both iPhone and Android — oToK's free generator shows a live "will it scan?" check for exactly this.
- 2Default to a dynamic code, not a static one, anywhere the destination might need to change or you actually want to know it's being scanned — a free oToK account lets you repoint a printed QR code's destination and see its scan count without reprinting anything.
- 3If the code opens a WhatsApp chat, put the prefilled message to work rather than leaving it as plain text: match it to a Keyword automation trigger (or just rely on First message for a brand-new contact), and the scan itself can start a welcome flow — no separate integration to build.
- 4Keep the encoded content short. A shorter link produces a less dense, easier-to-scan pattern, and — per the same logic the FBI's tampering PSA is built on — a long baked-in destination is exactly what a sticker-over-the-original attack is designed to exploit; a short, dynamic redirect is both cleaner and easier for a business to audit later.
- 5Treat a QR code on anything official-looking (a parking ticket, an invoice, a delivery notice) the way the Herzliya case argues you should as a consumer, and the way you should expect your own customers to eventually be taught to: verify the destination independently before entering payment or login details, especially if it arrived unsolicited — by mail, on a windshield, or from an account you didn't already know.
None of this requires treating QR codes as either a solved 2011 fad or a 2026 security emergency. The disclosed data says both things are modestly true at once: real, still-growing adoption sitting on top of a real, still-small measurement discipline — and a real, still-small but genuinely growing fraud category riding the same trust that makes the first part work.
Frequently asked questions
- Are QR codes actually still relevant for marketing in 2026, or is this leftover 2020 hype?
- The disclosed data says relevant, but under-measured. eMarketer's 2022 forecast projected US QR scanners growing from 83.4 million to 99.5 million by 2025, and Uniqode's 2026 survey (524 marketers, 1,000 consumers, 188M+ scans) found 98% of marketers reporting a positive impact and 60% planning to increase usage. The honest caveat: only 12% of those same marketers can actually connect a scan to revenue, so treat any specific ROI claim you read about QR codes with more skepticism than the adoption numbers themselves.
- How big is the QR phishing ("quishing") threat, really?
- It's real and independently documented — Barracuda detected 500,000+ QR-phishing emails hidden in PDFs in a single quarter of 2024, and the FBI has issued two separate PSAs on QR fraud (Jan 2022 and Jul 2025) — but the specific percentage most often quoted for how big it's gotten (a claimed rise from 12.4% to 10.8% to 12% of all phishing, 2023–2025) contradicts itself in its own source. The FBI's own 2025 alert calls the mailed-QR-package scam "not as widespread as other fraud schemes."
- What's the difference between a static and a dynamic QR code, and which should I use?
- A static code's destination is frozen the moment it's printed, with no way to see who scanned it. A dynamic code encodes a short redirect link instead, so you can repoint the destination and see scan activity after the code is already printed. Use static for anything permanent you'll never need to change or measure; use dynamic for anything tied to a campaign, or anywhere you want to know the code is actually being used.
- Is it safe to scan a QR code on something like a parking ticket or a delivery notice?
- Treat it the way Israel's National Cyber Directorate advised after a tampered Herzliya parking-ticket QR code circulated: don't scan-and-pay straight through it. Verify the destination independently through the organization's own site or app first, especially if the document arrived unsolicited — by mail, on a windshield, or from an account you didn't already recognize.
