Quishing: scams with QR codes and links in SMS

Quishing: scams with QR codes and links in SMS

You scan a QR code and your phone opens a website straight away. You have not read an address, typed anything or decided where to go: the QR code decided for you. That convenience is exactly what quishing (QR + phishing) exploits: QR codes and shortened links that hide their destination and take you to fake websites that steal your details or your money.

Quishing is not a separate technique from smishing (such as the fake traffic-fine or ERP charge SMS): it is the same deception with the link better hidden. Where a fake fine or parcel SMS still lets you spot a suspicious domain if you look closely, a QR code shows you nothing until you have already scanned it.

Where fake QR codes can show up

• Car parks. Stickers with a fake QR code placed on car park signs or payment notices, promising a quick way to pay. You scan, land on a site that imitates a parking payment page and enter your card details. Pay through the official app you installed yourself, such as Parking.sg for URA and HDB car parks, never through a sticker.
• Restaurant menus and tables. A QR code stuck over the original ordering code. Here the aim is usually to get you to install a fake app or to send you to a phishing site on some pretext.
• Fines and notices on the windscreen. Fake penalty notices with a QR code "to pay at a discount". The same hook as the fake fine SMS, on paper.
• Parcels and deliveries. QR codes on stickers or in SMS ("scan to reschedule your delivery"), a variant of the fake SingPost and courier messages.
• Emails and SMS with a QR code. The message asks you to scan a QR code instead of tapping a link, sometimes with the excuse of "two-factor verification" or "security". It also helps scammers get past anti-phishing filters, which check links but not images.
• Cryptocurrency and payments. QR codes that supposedly contain a payment address or a "refund". Once the money is sent, there is no getting it back.

The rule: look at the destination before you open it

With a normal link you can read the address before tapping. With a QR code you cannot, so you have to add that step yourself:

1. Scan, but do not open it yet. Most phones show the full URL before opening it. That is the moment to decide: read all of it, without rushing.
2. Check the domain. It must be the official one for that service, with no extra hyphens or odd extensions. If the QR code on a car park sign takes you to a domain that does not belong to the car park operator or the official app, it is fake.
3. If something does not add up, do not open it: go to the official channel yourself. Open the official parking, bank or shop app and do it there. It is the same method we explain in the guide to checking a call or SMS from your bank, which you will find among our guides.
4. Be wary of QR codes that rush you. "Scan now", "final notice", "your parcel will be returned today". Urgency is the signature of fraud, in a QR code just as in an SMS.

And a physical tip for QR codes stuck up in public places: check whether one sticker has been placed over another. If the code on a car park sign is on a sticker that looks as if it was added later, or covers another code underneath, do not use it. Pay through the official app you already have installed.

What to do if you have already scanned and entered details

• You entered your card details on the site: call your bank now, block the card and ask for a new one. If you think your bank account is at risk, use your bank's emergency "kill switch" to freeze it. Watch your statements over the coming weeks.
• You downloaded an app from the QR code: uninstall it, run your phone's security scan and review the permissions you gave it (SMS, accessibility and notifications are the dangerous ones). Be especially wary of any app installed from outside the official app stores, and if you use banking apps on that phone, call your bank as well.
• You only scanned and closed it: almost certainly nothing happened. Scanning alone installs nothing and hands over no data; the risk starts when you interact with the site.
• Make a police report online through SPF e-services, with photos of the QR code (if it was in a public place, a photo of the sticker and its location) and screenshots of the site. ScamShield's I've been scammed page lists the steps, and if you are not sure whether it was a scam, you can call the ScamShield Helpline on 1799.
• If the QR code reached you by SMS or in a call, report the number in the spam numbers directory.

Quick questions

Can scanning a QR code hack my phone? Scanning alone, no: a QR code only contains text (usually a URL). The danger lies in the site it takes you to and what you do there: entering details, downloading files or granting permissions. That is why the defence is checking the destination before you open it.

Are shortened links (bit.ly and the like) the same thing? The same problem, yes: they hide the destination. Legitimate shorteners let you preview the link (many with a "+" at the end of the URL), but the practical rule does not change: if you do not know where it leads and it urges you to tap, do not tap; go to the official channel yourself.

Can my bank or a government service show me a genuine QR code? Yes, for example to log in or to link an app, within a process that YOU started. A QR code that arrives without you having asked for anything follows the general rule: do not use it, and go to the official app yourself. And never approve a Singpass login that you did not start yourself.

How do I protect an older relative from this? With one sentence: "Don't pay anything by scanning a QR code stuck on a sign; use the app you already have." Car park signs and payment notices are an easy place for fake codes to hide. You will find more advice on the NoCall blog.

The summary fits in one line: a QR code is a link you cannot read, so read it before you open it. Scan, look at the URL, and if it is not the official domain, close it and go to the official channel yourself. That one-second pause defeats quishing entirely.