Quishing: scams using QR codes and links in texts

Quishing: scams using QR codes and links in texts

You scan a QR code and your phone opens a website straight away. You haven't read an address, typed anything or decided where to go: the QR code decided for you. That convenience is exactly what quishing (QR + phishing) exploits: QR codes and shortened links that hide their destination to take you to fake websites that steal your details or your money.

Quishing isn't a separate trick from smishing (scam texts, such as fake toll or fine texts): it's the same con with the link better hidden. Where a fake toll text or a fake parcel text still lets you spot a suspicious domain if you look closely, a QR code shows you nothing until you've already scanned it.

Where fake QR codes turn up

• Pay-and-display machines and parking signs. Stickers with a fake QR code stuck over the real one from the council or the official parking app. You scan, land on a website that imitates the parking payment page and enter your card. This is the classic version, and it works because everything around the sticker looks official.
• Restaurant menus and tables. A QR code stuck over the original. Here the aim is usually to get you to install a fake app or to take you to a phishing site on some pretext.
• Fines and notices on the windscreen. Fake parking tickets or penalty notices with a QR code "to pay now and avoid a higher charge". The same hook as fake fine texts, on paper.
• Parcels and deliveries. QR codes on stickers or in texts ("scan to rearrange your delivery"), a variant of parcel scams.
• Emails and texts with QR codes. The message asks you to scan a code instead of tapping a link, sometimes with the excuse of "two-step verification" or "security". It also helps them slip past anti-phishing filters, which check links but not images.
• Crypto and payments. QR codes that supposedly contain a payment address or a "refund". Once the money has gone, there's no getting it back.

The rule: check the destination before you open it

With a normal link you can read the address before tapping. With a QR code you can't, so you have to add that step yourself:

1. Scan, but don't open it yet. Most phones show the full web address before opening it. That's the moment to decide: read it to the end, without rushing.
2. Check the domain. It must be the official one for the service, with no extra hyphens or odd endings. If the QR code on a parking machine takes you to a domain that isn't the council's or the official parking app's, it's fake.
3. If anything doesn't add up, don't open it: go to the official channel yourself. Open the official parking, banking or shop app and do it there. It's the same method we use for checking a call or text from your bank.
4. Be wary of QR codes that rush you. "Scan now", "final notice", "your parcel will be returned today". Urgency is the signature of fraud, in QR codes as much as in texts.

And a physical tip for QR codes in the street: check whether one sticker has been put over another. If the QR code on a parking machine is on a sticker that looks added later, or covers another code underneath, don't use it. Pay through the official app you already have installed.

What to do if you've already scanned and given details

• You entered your card on the site: ring your bank now, block the card and ask for a new one. Keep an eye on your transactions over the following weeks.
• You downloaded an app from the QR code: uninstall it, run a security scan on your phone and review the permissions you gave it (texts, accessibility and notifications are the dangerous ones).
• You only scanned and closed it: almost certainly nothing happened. Scanning alone installs nothing and gives away no details; the risk starts when you interact with the website.
• Report it to the Gardaí at your local Garda station with photos of the QR code (if it was in the street, a photo of the sticker and where it was) and screenshots of the website. The Competition and Consumer Protection Commission (CCPC) has more advice in its guide to common scams.
• If the QR code reached you by text or call, report the number in the spam numbers directory.

Quick questions

Can scanning a QR code hack my phone? Scanning alone, no: a QR code only contains text (usually a web address). The danger is in the website it takes you to and what you do there: entering details, downloading files or granting permissions. That's why the defence is checking the destination before you open it.

Are shortened links (bit.ly and the like) the same thing? Same problem, yes: they hide the destination. Legitimate link shorteners let you preview where a link goes (many by adding a "+" to the end of the address), but the practical rule doesn't change: if you don't know where it leads and it's pushing you to tap, don't tap; go to the official channel yourself.

Can my bank send me a genuine QR code? Yes, for example to link the app or confirm a transaction... as part of a process YOU started. A bank QR code that turns up without you asking for anything follows the general rule: don't use it, and open the official app yourself.

How do I protect an older relative from this? With one sentence: "never pay by scanning a QR code in the street; use the app you already have". Parking machines are a common place to come across one. It's also worth sharing our step-by-step guides with them.

The summary fits in one line: a QR code is a link you can't read, so read it before you open it. Scan, look at the address, and if it isn't the official domain, close it and go to the official channel yourself. That one-second pause takes quishing apart completely.