Quishing: scams with QR codes and links in SMS

Quishing: scams with QR codes and links in SMS

You scan a QR code and your phone opens a website straight away. You have not read an address, typed anything or decided where to go: the QR code decided for you. That convenience is exactly what quishing (QR + phishing) exploits: QR codes and shortened links that hide their destination to take you to fake websites that steal your details or your money.

Quishing is not separate from smishing (scam texts with links, like the fake "BVN update" message): it is the same trick with the link better hidden. A fake bank or parcel text still lets you see a suspicious address if you look closely; a QR code shows you nothing until you have already scanned it.

Where fake QR codes show up

• Payment QR codes at shops and stalls. A sticker with a fake QR code is placed over the shop's real payment code. You scan and pay, the money lands in someone else's account, and the shop says you never paid. Other versions open a page that asks for your card details.
• Restaurant and bar menus. A QR code stuck over the original. Here the aim is usually to get you to install a fake app or to send you to a phishing site on any excuse.
• Recruitment and "grant" flyers. Posters, flyers and social media posts with a QR code that leads to a "recruitment form" or a "government grant" page, which then asks for a form fee, your BVN or your card details.
• Parcels and deliveries. A QR code on a sticker or in a text ("scan to reschedule your delivery"), a variant of parcel fraud.
• Emails and texts with a QR code. The message asks you to scan a code instead of tapping a link, sometimes with the excuse of "two-step verification" or "security". It also helps them get past anti-phishing filters, which check links but not images.
• Crypto and payments. QR codes that supposedly contain a payment address or a "refund". Once the money is sent, there is no getting it back.

The rule: look at the destination before you go in

With a normal link you can read the address before tapping. With a QR code you cannot, so you have to add that step yourself:

1. Scan, but do not open it yet. Most phones show the full address before opening it. That is the moment to decide: read all of it, without rushing.
2. Check the domain. It must be the service's official one, without extra hyphens or strange endings. Official government sites normally end in .gov.ng, and an address that only contains those letters somewhere in the middle is not one of them. If a payment code shows an account or merchant name that is not the shop's, stop.
3. If something does not add up, do not go in: use the official channel yourself. Open your bank's app, the shop's official app or the official website, and do it there. It is the same method we recommend for checking a call or SMS from your bank.
4. Be wary of QR codes that rush you. "Scan now", "final notice", "your parcel will be returned today". Urgency is the signature of fraud, in a QR code just as in a text.

And a physical tip for QR codes stuck up in public: check whether there is one sticker on top of another. If the QR code at a counter is on a sticker that looks added later, or covers another code underneath, do not use it. Ask the shop for its account details, or pay with the app you already have and check the account name before you send.

What to do if you already scanned and gave details

• You entered your card on the site: call your bank now, block the card and ask for a new one. Watch your debit alerts over the coming weeks. If your bank does not resolve an unauthorised debit, you can escalate the complaint to the Central Bank of Nigeria (CBN).
• You paid into the wrong account: tell your bank immediately with the transaction details. The sooner they know, the better the chance of stopping the money.
• You downloaded an app from the QR code: uninstall it, run a security scan and check the permissions you gave it (SMS, accessibility and notifications are the dangerous ones).
• You only scanned and closed it: almost certainly nothing happened. Scanning alone installs nothing and gives away nothing; the risk starts when you interact with the website.
• Report it to the police through the NPF-NCCC e-reporting portal, with photos of the QR code (if it was in public, a photo of the sticker and where it was) and screenshots of the website.
• If the QR code reached you by text or call, report the number in the spam numbers directory.

Quick questions

Can scanning a QR code hack my phone? Scanning alone, no: a QR code only contains text (usually a web address). The danger is the website it opens and what you do there: entering details, downloading files or granting permissions. That is why the defence is to check the destination before you go in.

Are shortened links (bit.ly and the like) the same thing? The same problem, yes: they hide the destination. Legitimate shorteners let you preview the address (many with a "+" at the end of the link), but the practical rule does not change: if you do not know where it leads and it pushes you to tap, do not tap, and use the official channel yourself.

Can my bank send me a genuine QR code? Yes, for example to link its app or confirm a transaction, within a process that YOU started. A bank QR code that arrives when you have asked for nothing follows the general rule: do not use it, and go into the official app yourself.

How do I protect an older relative from this? With one sentence: "Never pay by scanning a code you did not expect; use the app you already have and check the name before you send."

The summary fits on one line: a QR code is a link you cannot read, so read it before you go in. Scan, look at the address, and if it is not the official domain, close it and use the official channel yourself. That second of pause defeats quishing entirely.