Quishing: scams using QR codes and links in texts

Quishing: scams using QR codes and links in texts

You scan a QR code and your phone opens a website straight away. You haven't read an address, typed anything or decided where to go: the QR code decided for you. That convenience is exactly what quishing (QR + phishing) exploits: QR codes and shortened links that hide their destination to take you to fake websites that steal your details or your money.

Quishing isn't a separate technique from smishing (scam texts, like fake unpaid toll or fine notices): it's the same trick with the link better hidden. A fake toll, fine or parcel text still lets you see a suspicious web address if you look closely; a QR code shows you nothing until you've already scanned it.

Where fake QR codes turn up

• Parking meters and car parks. Stickers with a fake QR code stuck over the real one from the local council or the parking app. You scan it, land on a site that imitates the parking payment page and enter your card details. It's the classic version of this scam.
• Restaurant and cafe menus. A QR code stuck over the original. Here the aim is usually to get you to install a fake app, or to send you to a phishing site on any pretext.
• Fines and notices on your windscreen. Fake infringement notices with a QR code "to pay now and avoid extra fees". The same hook as fake fine texts, on paper.
• Parcels and deliveries. QR codes on stickers or in texts ("scan to rearrange your delivery"), a variant of parcel scams. Australia Post says it will never call, text or email you to request payment.
• Emails and texts with a QR code. The message asks you to scan a QR code instead of tapping a link, sometimes with a "two-step verification" or "security" excuse. It also helps scammers get past anti-phishing filters, which check links but not images.
• Cryptocurrency and payments. QR codes that supposedly contain a payment address or a "refund". Once the money's sent, there's no getting it back.

The rule: check the destination before you go in

With a normal link you can read the address before tapping. With a QR code you can't, so you have to add that step yourself:

1. Scan, but don't open it yet. Most phones show the full web address before opening it. That's the moment to decide: read the whole thing, without rushing.
2. Check the domain. It must be the service's official one, with no extra hyphens or odd endings. If the parking meter's QR code takes you to a domain that isn't the council's or the official parking app's, it's fake.
3. If something doesn't add up, don't go in: go to the official channel yourself. Open the official parking, bank or shop app and do it there. It's the same method we recommend for checking whether a call or text from your bank is real, in our guides.
4. Be wary of QR codes that rush you. "Scan now", "final notice", "your parcel will be returned today". Urgency is the signature of a scam, on a QR code just as in a text.

And a practical tip for QR codes stuck up in public: check for one sticker on top of another. If the parking meter's QR code is on a sticker that looks like it was added later, or covers another code underneath, don't use it. Pay through the official app you already have installed, and let the council know.

What to do if you've already scanned and entered details

• You entered your card on the site: call your bank now, block the card and ask for a new one. Keep an eye on your transactions over the following weeks.
• You downloaded an app from the QR code: uninstall it, run your phone's security scan and check which permissions you gave it (SMS, accessibility and notifications are the dangerous ones).
• You only scanned it and closed the page: almost certainly nothing happened. Scanning alone installs nothing and hands over no data; the risk starts when you interact with the website.
• Report it to Scamwatch, the national scam-reporting service, and, if you lost money, to police through ReportCyber, which you'll find via the AFP's cybercrime page. Include photos of the QR code (if it was in the street, a photo of the sticker and where it was) and screenshots of the website. IDCARE (1800 595 160) offers free support if your details were compromised.
• If the QR code reached you by text or call, report the number in the spam numbers directory. Telstra customers can also report the scam text as explained on Telstra's scams page.

Quick questions

Can scanning a QR code hack my phone? Scanning alone, no: a QR code only contains text (usually a web address). The danger is the website it takes you to and what you do there: entering details, downloading files or granting permissions. That's why the defence is checking the destination before you go in.

Are shortened links (bit.ly and the like) the same thing? Same problem, yes: they hide the destination. Legitimate shorteners let you preview the link (many with a "+" at the end of the address), but the practical rule is the same: if you don't know where it leads and it's rushing you to tap, don't tap; go to the official channel yourself.

Can my bank send me a legitimate QR code? Yes, for example to link its app or confirm a transaction... as part of a process that YOU started. A bank QR code that turns up without you asking for anything follows the general rule: don't use it, and open the official app yourself.

How do I protect an older relative from this? With one sentence: "never pay by scanning a QR code in the street; use the app you already have". Parking meters are a classic spot for fake stickers. You'll find more scam-prevention advice on our blog.

The whole thing fits in one line: a QR code is a link you can't read, so read it before you go in. Scan, look at the address, and if it isn't the official domain, close it and go to the official channel yourself. That one-second pause takes quishing apart.