QR codes are everywhere: restaurant menus, car parks, tickets, bills, information signs, adverts. Scanning them has become automatic. That's exactly why they have also become a vehicle for scams, which have been given a name of their own: quishing, a blend of QR and phishing.
Why a QR code is a good disguise
A QR code is simply a way of writing text, almost always a web address, as an image. The problem is that the address can't be read by eye. With a written link you can at least spot an odd domain; with a square of pixels you see nothing until you scan it.
Other factors make quishing effective:
- it switches devices: an email read on a computer contains a QR code to scan with your phone. The phone often has fewer protections, a smaller screen and partially hidden addresses;
- it slips past some filters: many spam systems analyse text links but struggle more with an address hidden inside an image;
- it exploits the physical world: a sticker placed over the original code on a parking meter or charging point isn't easily noticed.
The most common scenarios
Car parks and charging points
A sticker with a fake QR code is stuck over the genuine one or next to the instructions. Scanning it leads to a page that imitates the payment service and asks for card details.
"Corporate" emails
A message says your work mailbox password is about to expire, or that you need to sign a document, and invites you to scan a code to "continue securely on your phone". The page harvests your credentials.
Letters and paper notices
Fake notices of fines, held parcels or refunds also arrive by ordinary post, with a QR code to "pay now" or "verify your details".
Online marketplace sales
In private sales, the fake buyer sends a QR code saying it's needed to "receive the payment". In reality it leads to a page asking for card details, or starts a payment in the opposite direction.
How to scan a code safely
Look at the address preview
The camera on Android and iPhone shows the link before opening it. Read it: does the domain match the service you expect? Is it written strangely, with hyphens, extra letters or unusual extensions? If a link-shortening service is used, you can't know where it leads: in a payment context, that's a reason to stop.
Check the physical surface
On parking meters, charging points and signs, run a finger over the code: an overlaid sticker can be felt. If there are two codes, or the code looks as if it was added later, don't use it.
Prefer the official app
To pay for parking, charging or bills, use the service's official app from the store, or type in by hand the address shown on the sign. The QR code is a shortcut, not the only way.
Be wary of QR codes in emails
A service writing to you by email rarely needs you to scan a code to access your account. An email asking you to do so for "security" or "password expiry" reasons deserves maximum suspicion. Sign in to the service the way you always do, from your bookmarks or the app.
Never scan to receive money
To receive a payment you don't need to scan anything or enter your card details. If someone asks you to in an online sale, end the conversation.
After scanning: what not to do
Even if you've opened a page, it isn't too late. Stop if the page:
- asks for a password or card details for a trivial operation;
- asks you to install an app outside the official store;
- asks you to allow notifications or download a configuration profile.
If you've already entered details, follow the same rules as for phishing: block the card through your bank, change your password from the official site and turn on two-step verification.
For people running a business
If you use QR codes for menus or payments in your venue or shop:
- check regularly that they haven't been covered or replaced;
- print the website address next to the code, so customers can verify it;
- for codes displayed outdoors, use mounts that are hard to tamper with, for example behind a transparent cover.
In short
- Quishing hides a malicious link inside a QR code, which can't be read by eye.
- It often moves the victim from computer to phone and gets around some filters.
- Always read the address preview before opening it.
- On parking meters and charging points, check for overlaid stickers and prefer the official app.
- Be wary of QR codes in emails and never scan one to receive a payment.