Quishing: scams using QR codes and links in text messages

Quishing: scams using QR codes and links in text messages

You scan a QR code and your phone opens a website straight away. You haven't read an address, typed anything or decided where to go: the QR code decided for you. That convenience is exactly what quishing (QR + phishing) exploits: QR codes and shortened links that hide where they lead, taking you to fake websites that steal your details or your money.

Quishing isn't a separate technique from smishing (scam texts about an unpaid fine or toll, for example): it's the same con with the link better hidden. Where a fake fine or parcel text still lets you spot a dodgy domain if you look closely, a QR code shows you nothing until you've already scanned it. You'll find those text scams in our situation guides.

Where fake QR codes show up

• Parking machines and car parks. Stickers with a fake QR code stuck over the real one from the council or the parking app. You scan, land on a site imitating the parking payment page and enter your card. It's the classic version, because people pay in a hurry and don't look twice.
• Restaurant menus and café tables. A QR code stuck over the original. Here the aim is usually to get you to install a fake app or to take you to a phishing site on some pretext.
• Fines and notices on the windscreen. Fake parking or infringement notices with a QR code "to pay now and avoid extra fees". The same hook as fake fine texts, on paper.
• Parcels and deliveries. QR codes on stickers or in texts ("scan to reschedule your delivery"), a variation on the parcel scam.
• Emails and texts with a QR code. The message asks you to scan a QR code instead of tapping a link, sometimes with an excuse like "two-step verification" or "security". It also helps scammers get past anti-phishing filters, which check links but not images.
• Cryptocurrency and payments. QR codes that supposedly contain a payment address or a "refund". Once the money's sent, there's no getting it back.

The rule: look at the destination before you open it

With a normal link you can read the address before tapping. With a QR code you can't, so you need to add that step yourself:

1. Scan, but don't open it yet. Most phones show the full web address before opening it. That's the moment to decide: read the whole thing, without rushing.
2. Check the domain. It must be the service's official one, with no extra hyphens or odd extensions. If the QR code on a parking machine takes you to a domain that isn't the council's or the official parking app's, it's fake.
3. If something doesn't add up, don't go in: go to the official channel yourself. Open the official parking, bank or shop app and do it there. It's the same method we recommend for checking a call or text from your bank.
4. Be wary of QR codes that rush you. "Scan now", "final notice", "your parcel is being returned today". Urgency is the signature of fraud, in QR codes just as in texts.

And a practical tip for QR codes stuck up in public places: check whether there's one sticker on top of another. If the QR code on a parking machine is on a sticker that looks like it was added later, or covers another code underneath, don't use it. Pay through the official app you already have installed.

What to do if you've already scanned and given details

• You entered your card on the site: call your bank now, block the card and ask for a new one. Keep an eye on your transactions over the following weeks.
• You downloaded an app from the QR code: uninstall it, run your phone's security scan and review the permissions you gave it (texts, accessibility and notifications are the dangerous ones).
• You only scanned and closed it: almost certainly nothing happened. Scanning on its own installs nothing and gives away no details; the risk starts when you interact with the site.
• Report it to the National Cyber Security Centre (NCSC), or to NZ Police on 105 if you've lost money, with photos of the QR code (if it was in a public place, a photo of the sticker and where it was) and screenshots of the site. If it was on a parking machine, let the council or the parking operator know too. Own Your Online's scam check can help you size up a suspicious message.
• If the QR code came in a text, forward the text free to 7726, the Department of Internal Affairs' scam-text reporting service. Whether it came by text or in a call, report the number in the spam numbers directory.

Quick questions

Can scanning a QR code hack my phone? Scanning on its own, no: a QR code only contains text (usually a web address). The danger is the website it takes you to and what you do there: entering details, downloading files or granting permissions. That's why the defence is checking the destination before you go in.

Are shortened links (bit.ly and the like) the same thing? The same problem, yes: they hide the destination. Legitimate link shorteners let you preview the address (many by adding a "+" to the end of the link), but the practical rule is the same: if you don't know where it leads and it's pushing you to tap, don't tap, and go to the official channel yourself.

Can my bank send me a legitimate QR code? Yes, for example to link its app or confirm a transaction... as part of something YOU started. A QR code from your bank that arrives without you asking for anything follows the general rule: don't use it, and open the official app yourself.

How do I protect an older person from this? With one sentence: "Don't pay for anything by scanning a QR code in the street; use the app you already have." Parking machines are a common place to come across them. You'll find more advice on the NoCall blog.

The summary fits on one line: a QR code is a link you can't read, so read it before you open it. Scan, look at the address, and if it isn't the official domain, close it and go to the official channel yourself. That one-second pause takes the sting out of quishing completely.