QR Code News 2026: 8 Changes Small Businesses Should Know

QR code news in 2026 pulls in two directions. The FBI, the FTC, city authorities, Meta and Microsoft published warnings and attack counts about malicious codes, while standards bodies and a tax agency kept building QR codes into barcodes, standards and invoices. Eight dated developments follow; where a source supports one, each ends with what it means for a small business.

Facts checked on 17 October 2026.

The eight developments at a glance

Warnings about malicious QR codes

1. The FBI said QR codes slip past email filters

The FBI's FLASH AC-000001-MW of 8 January 2026 describes the North Korean group Kimsuky emailing QR codes to think tanks and government bodies. The FBI says campaigns commonly deliver QR images as attachments or embedded graphics, which evade URL inspection, rewriting and sandboxing and move the victim to a phone. It advises training staff on unsolicited codes "regardless of their source (email, letter, flyer, packaging)".

For a small business: the alert targets organisations with ties to North Korea, not shops. Its check is simple: confirm an unexpected code with the sender through another channel before entering a password or downloading a file.

2. Microsoft counted QR phishing rising, then falling

Microsoft's Q1 2026 email threat report says QR code attacks rose from 7.6 million in January to 18.7 million in March. Its Q2 report says volume fell 7% in April to 17.4 million, dropped 38% in May and closed June at 8.3 million, when QR phishing "returned to levels last seen in mid-2025".

For a small business: these are one vendor's detection counts (vendor data), and the QR sections do not explain how an attack is counted, so read them as a trend, not an industry total. Our guide to spotting a fake QR code applies either way.

3. Fake stickers appeared on parking machines

The City of Mississauga warned on 24 April that "Any QR code found on a City paid parking machine is not legitimate", and said roughly 80 fraudulent stickers were removed. The FTC's 3 September alert says people reported scammers covering real QR codes on parking meters with their own, and advises checking the link preview for spelling mistakes or switched letters. Auckland Transport said on 8 September that it uses no QR codes on any of its parking meters or machines.

For a small business: the two authorities gave drivers a rule that needs no inspection, and the FTC adds a check for codes that do exist. For your own printed codes, see protecting printed QR codes from sticker scams.

4. WhatsApp announced warnings about device linking

Meta's 11 March 2026 announcement says scammers may try to trick people into linking a WhatsApp account to their device, including by getting them to scan a QR code under false pretenses. WhatsApp's alerts show where the request comes from and warn that it could be a scam.

For a small business: in Meta's account, scanning a QR code is one of the ways scammers try to get an account linked to their device.

Barcodes and standards

5. GS1 wants checkout scanners to read 2D barcodes by the end of 2027

GS1, the barcode standards body, says in an August 2026 position paper that industry has set a goal: by the end of 2027, all retail point-of-sale systems should be able to read a defined set of GS1-conformant 2D barcodes. Its December 2025 guideline calls the transition "voluntary" and says linear barcodes "will not go away". That guideline calls the goal "Ambition 2027"; GS1 US calls it Sunrise 2027 and says implementing every 2D capability by then is not necessary. The checkout formats are GS1 DataMatrix, a Data Matrix with GS1 Digital Link URI syntax, and a QR code with GS1 Digital Link URI syntax. A QR code holding an ordinary web address, not written in GS1 Digital Link URI syntax, is not one of them.

In April 2026, Tesco said in a press release that it was moving 13 lines of its own-label sausages from barcodes to QR codes, and described itself as the first UK supermarket to upgrade an entire product range to the new system. As of October 2026 the GS1 goal is a voluntary industry target, not a law, and this is not legal advice.

For a small business: a code on the pack for shoppers to scan at home is separate from the checkout barcode. A dynamic code, such as those from QR Maker AI (three active ones on the free plan, as of October 2026), encodes a short link, so after you change the destination the next scan goes to the new address, with no reprint. It is not a GS1 Digital Link code and will not replace your barcode at checkout. See QR codes for product packaging, how long a QR code link must keep working or create a dynamic code.

6. ISO started work on a fifth edition of the QR code standard

ISO's committee page lists ISO/IEC 18004 Edition 5 as under development, intended to replace ISO/IEC 18004:2024, with the project approved on 25 February 2026 and the comment period closing on 19 June 2026.

For a small business: the page does not say what will change, so there is nothing to plan for yet.

Payments and invoices (regional)

7. India: a UPI merchant fee takes effect from 15 October

NPCI's FAQ document, dated 15 September 2026, says a merchant discount rate of 0.4% applies to person-to-merchant UPI payments above ₹2,000 from 15 October 2026, capped at ₹300 per payment from ₹75,000, with different rates for some sectors. Payments up to ₹2,000 are unaffected, and small merchants receiving up to ₹1 lakh a month through UPI QR directly into their accounts stay at zero fee.

For a small business: NPCI says existing QR stands and soundboxes need not be replaced. The document pre-dates the start date, and no data on the rule's effect is in the sources here.

8. Spain: invoicing-system rules add a QR code to invoices

Spain's tax agency, on a page updated 13 October 2026, says that once the invoicing-system (SIF) rules apply to an issuer, all invoices, complete or simplified, must carry a QR code. A December 2025 decree-law sets the deadline for invoicing systems at before 1 January 2027 for taxpayers under article 3.1.a) and before 1 July 2027 for the rest of article 3.1.

For a small business: the QR code applies to issuers inside the invoicing-system rules, which the tax agency's page says do not cover operations that need no invoice, so check whether they cover you. These dates are as of October 2026 and may change, so check the official text. This is not legal advice.

FAQ

Is QR code phishing increasing in 2026?

Microsoft's Q1 report counts rose from 7.6 million attacks in January to 18.7 million in March, then its Q2 report shows a fall to 8.3 million in June. That is one vendor's data, not an industry total.

Will QR codes replace barcodes at the checkout?

GS1's goal is that by the end of 2027 checkout scanners can read both linear and 2D barcodes, and its guideline says linear barcodes will not go away. The transition is voluntary.

Does any of this change how my ordinary QR code works?

In the sources we read, none says that a QR code that opens a web page will be made or read differently. The ISO page lists a fifth edition of the standard under development but does not say what it would change, and the GS1, payment and invoice items concern specific formats.

Sources

1. FBI Internet Crime Complaint Center — North Korean Kimsuky Actors Leverage Malicious QR Codes in Spearphishing Campaigns Targeting U.S. Entities (FLASH AC-000001-MW). Published 8 January 2026. Accessed 17 October 2026.
2. Microsoft Threat Intelligence — Email threat landscape: Q1 2026 trends and insights. Published 30 April 2026. Accessed 17 October 2026. (vendor data)
3. Microsoft Threat Intelligence — Email threat landscape: Q2 2026 trends and insights. Published 23 July 2026. Accessed 17 October 2026. (vendor data)
4. City of Mississauga — City warns about fraudulent QR codes on parking machines. Published 24 April 2026. Accessed 17 October 2026.
5. Federal Trade Commission — See a QR code parked somewhere? Don't scan it...yet!. Published 3 September 2026. Accessed 17 October 2026.
6. Auckland Transport — Aucklanders warned about scam parking meter QR codes. Published 8 September 2026. Accessed 17 October 2026.
7. Meta — Meta Launches New Anti-Scam Tools, Deploys AI Technology to Fight Scammers and Protect People. Published 11 March 2026. Accessed 17 October 2026.
8. GS1 — Position Paper: Migration to a single GS1 conformant 2D barcode for retailer private label, retailer-exclusive and in-store labelled products. Release 2.0, August 2026. Accessed 17 October 2026.
9. GS1 — 2D Barcodes at Retail Point-of-Sale Implementation Guideline. Release 1.1.0, ratified December 2025. Accessed 17 October 2026.
10. GS1 US — What is GS1 Sunrise 2027?. Undated. Accessed 17 October 2026.
11. Tesco PLC — Tesco sausage range becomes first UK products to switch over exclusively to QR codes. Published 20 April 2026. Accessed 17 October 2026.
12. ISO/IEC JTC 1/SC 31 — ISO/IEC WD 18004, QR code bar code symbology specification (Edition 5). Stage dates February to June 2026. Accessed 17 October 2026.
13. National Payments Corporation of India — Merchant Discount Rate (MDR) on Select UPI (P2M) Transactions: Frequently Asked Questions. Dated 15 September 2026. Accessed 17 October 2026.
14. Agencia Tributaria (Spain) — Cuestiones generales: Sistemas informáticos de facturación y VERI*FACTU. Page updated 13 October 2026. Accessed 17 October 2026.
15. Boletín Oficial del Estado — Real Decreto-ley 15/2025, de 2 de diciembre. Published 3 December 2025. Accessed 17 October 2026.