QR code scams: quishing
A QR code doesn’t show where it leads, and scammers exploit that. A sticker on a parking meter, a fake letter, an “urgent” e-mail: here’s how not to fall for it.
What is quishing?
It’s phishing by QR code: the code leads to a fake page imitating a real service, to make you pay or enter your login details. The word blends “QR” and “phishing”.
The scammers’ trick: you can’t see a code’s address before scanning, and people tend to trust a code in a public place.
Where do fake QR codes turn up?
On parking meters and EV chargers (a sticker over the real code), in fake letters or delivery notices, in e-mails asking you to “verify your account”, on flyers tucked under windscreen wipers.
- A sticker code placed over another one, or crooked.
- Urgency: a fine to pay, an account locked, a parcel waiting.
- A page asking for card details or a password right after the scan.
- An address that looks like the real site, one letter off.
How do I protect myself when scanning?
Read the address before opening, and don’t pay or sign in from a code found in the street or received unasked. If in doubt, type the service’s official address yourself or use its app.
How to scan is covered in scanning a QR code on iPhone or Android. If you’ve already paid, contact your bank straight away.
What does Scanotte do against malicious codes?
Scanotte’s code provides for checking every destination with Google Web Risk when it’s saved, when that service is switched on: a destination known to be dangerous would then be refused, and those being scanned re-checked daily, since a page can turn malicious later.
Anyone can report a Scanotte code or link from the report page; a blocked link shows a warning instead of redirecting. The app also warns creators when a link looks like a login or payment page. More in are short links safe?.
How can I reassure people who scan my codes?
Print the code directly on your material rather than as a sticker, say next to it what it opens and your site’s name, and check regularly that nobody has stuck anything over it.
For payments, link to your real payment page, never an improvised form; see also the SEPA payment QR code.
Are QR codes in e-mails safe?
Be extra careful: a code in an e-mail can be used to slip past link filters, and scanning moves you from your computer to your phone, where the address is harder to check.
If a message asks you to scan to “unlock” an account or settle a payment, go to the official site or app yourself instead.
Frequently asked questions
Can scanning a code hack my phone?
Scanning alone only shows an address. The danger is what you do next on the page: entering data, paying, downloading.
How do I report a suspicious Scanotte code?
Use Scanotte’s report page with the address shown when scanning. The team can block the link.
Is the QR code on a paper fine reliable?
Always check by typing the official address given by the authority yourself rather than following the code.
Are restaurant codes risky?
Rarely, but a sticker placed over one could be. Check the address: it should match the restaurant or its provider.