# I Scanned a QR Code to Use a Public Bike… Could It Be a Scam?

> URL: https://www.cityhorror.wiki/en/%EC%A3%BC%EC%B0%A8-%EB%94%B1%EC%A7%80%EC%99%80-%EA%B3%B5%EA%B3%B5%EC%9E%90%EC%A0%84%EA%B1%B0-%EA%B0%80%EC%A7%9C-QR%EC%BD%94%EB%93%9C
> Estimated date: Sep 2023 ~ Sep 2026
> Last updated: 2026-10-28
> Korean original: https://www.cityhorror.wiki/%EC%A3%BC%EC%B0%A8-%EB%94%B1%EC%A7%80%EC%99%80-%EA%B3%B5%EA%B3%B5%EC%9E%90%EC%A0%84%EA%B1%B0-%EA%B0%80%EC%A7%9C-QR%EC%BD%94%EB%93%9C

## Overview

From around 2023, warnings about a technique known as Qshing began to circulate in South Korea. The stories claimed that people had lost personal information and money after scanning QR codes on parking tickets placed on cars or on public bicycles.

Qshing is a portmanteau of QR code and phishing. Because QR codes can be scanned simply by pointing a smartphone camera at them, users cannot see where they lead before scanning. This weakness made QR codes a new avenue for scammers once phishing via text messages became widely known. Since these stories mixed real incidents from overseas with domestic warnings and illustrative examples, it is worth examining which parts actually happened.

## How the Story First Came to Light — Newsis Report (2023)

One of the reports that brought the story to wide attention in South Korea was Newsis’s October 15, 2023 article, “I Scanned a QR Code to Rent a Public Bike… But Was It a Scam?” The article opens with a scene in which Mr. A briefly stops at a convenience store while driving. When he returns five minutes later, he finds a parking ticket on his car. Flustered, he scans the QR code on the ticket, installs an app as instructed, and enters his personal information. A few days later, he discovers that his information has been stolen.

The article then introduces two cases from overseas. In China, parking tickets printed with fake QR codes were found under car windshield wipers. In Madrid, Spain, a payment QR code attached to a public bicycle turned out to belong to scammers. The article adds that cases of phishing in South Korea had also emerged in which money was withdrawn without victims’ knowledge using fraudulent QR codes, prompting financial authorities to issue a warning. It concludes with advice from the security industry to check who provided a QR code before scanning it if its source is unclear.

## What Actually Happened — Madrid Public Bicycles (2023)

The Madrid case really happened. In September 2023, an X user spotted and reported a fake QR-code sticker placed over the genuine code on a BiciMAD public bicycle. The City of Madrid filed a complaint with the National Police. According to Spanish media, scanning the sticker led to a website designed to look just like BiciMAD’s, which asked users to pay by card to unlock a bicycle.

One notable detail was that the fake QR code did not work when scanned with the official BiciMAD app; the fake site opened only when users scanned it with their smartphone’s default camera. As a result, local advice urged people to scan public-place QR codes only with the official app for the relevant service. However, reports did not say how many people were actually affected or how much money was lost.

## The Method Spreads to South Korea — Ddareungi and E-Scooters (2024)

The same method began to be spotted in South Korea the following year. In February and March 2024, social media posts spread claiming that fake QR-code stickers had been placed over the codes on Seoul’s Ddareungi public bicycles. The Seoul Facilities Corporation sent Qshing warnings to users of the Ddareungi app. It also began patrols to check public-bicycle terminals for damaged QR codes and stickers placed over them.

In October 2024, six government ministries, including the Ministry of Science and ICT, issued a joint Qshing warning. The government said it had confirmed attempts in South Korea to place Qshing stickers over genuine QR codes on shared e-scooters to encourage small-value payments, as well as attempts to embed Qshing in online ads and emails and urge people to install an app described as “necessary for secure transactions.” This shows that QR-code stickers on public bicycles and e-scooters were not merely an overseas concern: the method had also been tried in South Korea.

## Growing Losses (2026)

In September 2026, Maeil Shinmun reported, citing data from the Ministry of Science and ICT and the Korea Internet & Security Agency (KISA), that detections of text-message scams impersonating public institutions over fines and penalties had risen from 17,726 in 2022 to 1,258,228 in 2024—a 71-fold increase in two years. According to the same report, the Gyeonggi Nambu Provincial Police Agency received a report of a case in which a victim scanned a QR code labeled “Electronic Financial Fraud Prevention” attached to an email about a low-interest loan. A hacking app was installed, and 10 million won was withdrawn from the victim’s bank account. The Financial Supervisory Service also received a report of a case in which someone followed instructions to complete additional verification via QR code, resulting in a malicious app being installed and a 350,000-won small-value payment being charged. Analysts have also suggested that criminal organizations are turning to QR codes as phone calls and text messages are blocked.

## Authenticity Debate

The central question is **whether people in South Korea are actually being robbed after scanning QR codes on parking tickets and public bicycles, or whether this is an exaggerated warning story based on overseas incidents and illustrative examples**.

### The View That It Is a Real Threat

There is ample evidence that the method itself is real. Fake QR-code stickers were actually placed on bicycles in Madrid, prompting the city to file a police complaint. The same kind of sticker was also spotted on Ddareungi bicycles and shared e-scooters in South Korea, leading the responsible authorities to notify users and conduct patrols. The fact that six government ministries issued a joint warning identifying types of attempts confirmed in South Korea shows that this was not a vague rumor. In addition, a real case was reported in which 10 million won was lost after a hacking app was installed through a QR code. Given that QR codes conceal their destination address until they are scanned, is it only a matter of time before losses increase?

### The View That It Has Been Exaggerated

However, the most vivid scenes in the story have weak evidentiary support when examined closely. The opening scene in the Newsis article, in which “Mr. A had his personal information stolen after scanning a QR code on a parking ticket,” appears to be an illustrative scenario with no source provided, so it is difficult to treat it as a confirmed real incident. The headline of Maeil Shinmun’s 2026 article reads, “Scan a Qshing QR Code on a Parking Ticket, and 10 Million Won Is Withdrawn,” but the 10-million-won loss described in the article involved a QR code in a loan-offer email, not a parking ticket. The reports reviewed for this article did not confirm any actual financial loss in South Korea caused by a fake QR code on a parking ticket, and the scale of the losses in the Madrid case is also unknown. It is therefore more accurate to regard the “parking-ticket QR code” story as a warning about a plausible method rather than an account of an actual victim—and to say that this warning has been circulating as though it were a true story.

## Trivia

- Some reports say the fake Madrid website asked users to pay in pounds, rather than euros, to unlock the bicycle.
- The government advises people who find a QR code they suspect may be involved in Qshing, or who suspect that a malicious app has infected their device, to report it to the National Police Agency or the Financial Supervisory Service’s “Sagi Jeonhwa Jikimi” (Scam Call Watch) service, or to call KISA at 118, with no area code. The service offers free consultations 24 hours a day.

## Sources

The story began with a Newsis article dated October 15, 2023, by reporter Song Hye-ri. The Madrid case is based on Spanish reports including Genbeta (September 13, 2023); the Ddareungi case in South Korea is based on reports from March 2024, including MBC and Insight; domestic attempts are based on the Ministry of Science and ICT’s Policy Briefing (October 24, 2024); and the statistics and reported financial-loss cases are based on Maeil Shinmun (September 24, 2026, by reporter Jeong Jin-uk).

## Verified facts

- Qshing is a portmanteau of QR code and phishing. It is a scam that uses fake QR codes to induce people to install malicious apps or visit fake payment pages, thereby stealing personal and financial information.
- In September 2023, a report by an X user revealed that fake QR stickers had been placed over genuine QR codes on Madrid’s public bike-sharing system, BiciMAD. The city of Madrid filed a complaint with the National Police. Scanning with the official app did not work, while scanning with a regular camera opened a fake payment page.
- On October 15, 2023, Newsis warned about Qshing, reporting on fake QR parking tickets in China and scam QR codes on Madrid’s public bikes.
- In February–March 2024, social media posts claiming that fake QR stickers had been placed over QR codes on Seoul’s Ttareungi bikes spread widely. The Seoul Facilities Corporation sent Ttareungi app users a warning about Qshing.
- In a joint warning issued in October 2024, the Ministry of Science and ICT and five other ministries said that attempts to place Qshing stickers over QR codes used to pay for shared electric scooters had been identified in Korea, as had attempts to use Qshing in online ads and emails.
- According to materials from the Ministry of Science and ICT and KISA, detections of text-message scams impersonating public institutions, such as messages about fines and administrative penalties, rose from 17,726 in 2022 to 1,258,228 in 2024—a 71-fold increase in two years (Maeil Shinmun, September 2026).
- The Gyeonggi Nambu Provincial Police Agency received a report of a case in which scanning a QR code in an email advertising a low-interest loan, labeled “Preventing Electronic Financial Fraud,” installed a hacking app and resulted in 10 million won being taken.

## Points of dispute

- The opening of the Newsis article describes “Person A, whose personal information was stolen after scanning a QR code on a parking ticket.” This appears to be a hypothetical example for explanatory purposes, as no source for the case is given.
- Despite the article headline “1 million won withdrawn after scanning a Qshing QR code on a parking violation notice,” the 10 million won loss described in the article involved a QR code in a loan advertisement email, not a parking ticket.
- The reports found for this article do not confirm any case of actual financial loss in Korea caused by a fake QR code on a parking ticket, although warnings and advisories have been issued.