Quishing: scams with QR codes and links in text messages

Quishing: scams with QR codes and links in text messages

You scan a QR code and your phone opens a website straight away. You haven't read an address, typed anything or decided where to go: the QR code decided for you. That convenience is exactly what quishing (QR + phishing) exploits: QR codes and shortened links that hide their destination to send you to fake websites that steal your details or your money.

Quishing isn't a separate technique from smishing (such as the fake DVLA vehicle-tax text): it's the same trick with the link better hidden. Where a fake DVLA or parcel text still lets you spot a suspicious domain if you look closely, a QR code shows you nothing until you've already scanned it.

Where fake QR codes turn up

• Parking meters and car parks. Stickers with a fake QR code placed over the council's genuine code or the parking app's. You scan, land on a site imitating the parking payment page and enter your card details. If you normally pay through an official parking app such as RingGo or PayByPhone, use the app you already have.
• Restaurant menus and pub tables. A QR code stuck over the original. Here the aim is usually to get you to install a fake app or to send you to a phishing site on some pretext.
• Fines and notices on the windscreen. Fake penalty notices with a QR code "to pay at the reduced rate". The same hook as the fake parking-fine texts, on paper.
• Parcels and deliveries. QR codes on stickers or in texts ("scan to rearrange your delivery"), a variant of the fake Royal Mail and Evri messages.
• Emails and texts with a QR code. The message asks you to scan a QR code instead of tapping a link, sometimes with the excuse of "two-step verification" or "security". It also helps them slip past anti-phishing filters, which check links but not images.
• Cryptocurrency and payments. QR codes that supposedly contain a payment address or a "refund". Once the money has gone, there's no getting it back.

The rule: look at the destination before you go in

With a normal link you can read the address before tapping. With a QR code you can't, so you have to add that step yourself:

1. Scan, but don't open it yet. Most phones show the full web address before opening it. That's the moment to decide: read all of it, without rushing.
2. Check the domain. It must be the service's official one, with no extra hyphens or odd endings. If the parking meter's QR code takes you to a domain that isn't the council's or the official parking app's, it's fake.
3. If something doesn't add up, don't go in: go to the official channel yourself. Open the official parking, banking or shopping app and do it there. It's the same method we recommend for checking a call or text from your bank (see our step-by-step guides).
4. Be wary of QR codes that rush you. "Scan now", "final notice", "your parcel will be returned today". Urgency is the signature of fraud, on a QR code just as in a text.

And a practical tip for QR codes stuck up in the street: check whether one sticker has been put over another. If the parking meter's QR code is on a sticker that looks as if it was added later, or covers another code underneath, don't use it. Pay from the official app you already have installed.

What to do if you've already scanned and handed over details

• You entered your card details on the site: call your bank now, block the card and ask for a new one. Keep an eye on your statements over the following weeks.
• You downloaded an app from the QR code: uninstall it, run a security scan on your phone and check the permissions you gave it (SMS, accessibility and notifications are the dangerous ones).
• You only scanned and closed it: almost certainly nothing happened. Scanning alone doesn't install anything or give away any data; the risk starts when you interact with the website.
• Report it with photos of the QR code (if it was in the street, a photo of the sticker and where it was) and screenshots of the website: to Report Fraud (formerly Action Fraud) on 0300 123 2040 in England, Wales and Northern Ireland, or to Police Scotland on 101. Let the council or car park operator know too, so the sticker can be removed. For advice, contact the Citizens Advice consumer service (in Scotland, Advice Direct Scotland; in Northern Ireland, Consumerline).
• If the scam reached you by text, forward it to 7726 (how to report a scam text); if it came by email, forward it to [email protected] (GOV.UK guidance). And report the number in the spam numbers directory.

Quick questions

Can scanning a QR code hack my phone? Scanning alone, no: a QR code only contains text (usually a web address). The danger lies in the website it takes you to and what you do there: entering details, downloading files or granting permissions. That's why the defence is checking the destination before you go in.

Are shortened links (bit.ly and the like) the same thing? The same problem, yes: they hide the destination. Legitimate link shorteners let you preview where a link goes (many if you add a "+" to the end of the address), but the practical rule doesn't change: if you don't know where it leads and it's urging you to tap, don't; go to the official channel yourself.

Can my bank send me a genuine QR code? Yes, for example to link its app or confirm a transaction... as part of a process that YOU started. A bank QR code that arrives when you haven't asked for anything follows the general rule: don't use it, and open the official app yourself.

How do I protect an older relative from this? With one sentence: "never pay by scanning a QR code in the street; use the app you already have". Parking meters are the most likely place to come across one. You'll find more advice on the NoCall blog.

The summary fits on one line: a QR code is a link you can't read, so read it before you go in. Scan, look at the address, and if it isn't the official domain, close it and go to the official channel yourself. That one-second pause is enough to defeat quishing.