Quishing: QR code scams and links in text messages

Quishing: QR code scams and links in text messages

You scan a QR code and your phone opens a website directly. You haven't read an address, typed anything, or decided where to go: the QR code decided for you. That convenience is exactly what quishing (QR + phishing) exploits: QR codes and shortened links that hide their destination so they can take you to fake sites that steal your information or your money.

Quishing isn't separate from smishing (like the fake unpaid-toll text): it's the same trick with the link better hidden. A fake toll text or a fake package delivery text at least lets you spot a suspicious domain if you look closely; a QR code shows you nothing until you've already scanned it.

Where fake QR codes show up

• Parking meters and pay stations. Stickers with a fake QR code placed over the real one from the city or its parking app. You scan, land on a site that imitates the parking payment page, and enter your card number.
• Restaurant menus and tables. A QR code stuck over the original. Here the goal is usually to get you to install a fake app or send you to a phishing site on some pretext.
• Fake tickets on your windshield. Fake parking tickets with a QR code "to pay now and avoid a late fee." Same hook as the fake unpaid-toll or DMV-fine text, on paper.
• Packages and deliveries. QR codes on stickers or in texts ("scan to reschedule your delivery"), a variant of the fake package text.
• Emails and texts with a QR code. The message asks you to scan a code instead of tapping a link, sometimes with the excuse of "two-step verification" or "security." It also helps them get around anti-phishing filters, which check links but not images.
• Crypto and payments. QR codes that supposedly contain a payment address or a "refund." Once the money is sent, there's no getting it back.

The rule: look at the destination before you go in

With a normal link, you can read the address before tapping. With a QR code you can't, so you have to add that step yourself:

1. Scan, but don't open it yet. Most phones show the full URL before opening it. That's the moment to decide: read it all the way through, without rushing.
2. Check the domain. It should be the service's official one, with no extra hyphens or odd endings. If the parking-meter QR code takes you to a domain that isn't the city's or its official parking app's, it's fake.
3. If something doesn't add up, don't go in: go to the official channel yourself. Open the official parking, bank, or store app and do it there. It's the same method as checking whether a call or text from your bank is real.
4. Be wary of QR codes that rush you. "Scan now," "final notice," "your package will be returned today." Urgency is the signature of fraud, in a QR code just as in a text.

And a physical tip for QR codes in public places: check whether one sticker has been placed over another. If the parking-meter QR code is on a sticker that looks like it was added later, or covers another code underneath, don't use it. Pay through the official app you already have installed.

What to do if you already scanned and entered information

• You entered your card on the site: call your bank now, block the card, and ask for a new one. Watch for charges over the following weeks.
• You downloaded an app from the QR code: uninstall it, run a security scan on your phone, and review the permissions you gave it (text messages, accessibility, and notifications are the dangerous ones).
• You only scanned and closed it: almost certainly nothing happened. Scanning alone doesn't install anything or hand over any data; the risk starts when you interact with the site.
• Report it at ReportFraud.ftc.gov with photos of the QR code (if it was on the street, a photo of the sticker and where it was) and screenshots of the site. If it was on a parking meter, let the city know too (many cities take reports through 311), and if you lost money, file a report with your local police.
• If the QR code reached you by text or call, report the number in the spam numbers directory.

Quick questions

Can scanning a QR code hack my phone? Scanning alone, no: a QR code only contains text (usually a URL). The danger is the site it takes you to and what you do there: entering information, downloading files, or granting permissions. That's why the defense is checking the destination before you go in.

Are shortened links (bit.ly and the like) the same thing? Same problem, yes: they hide the destination. Legitimate shorteners let you preview the link (many with a "+" at the end of the URL), but the practical rule is the same: if you don't know where it leads and it's pushing you to tap, don't tap; go to the official channel yourself.

Can my bank send me a legitimate QR code? Yes, for example to link the app or confirm a transaction... as part of a process that YOU started. A QR code from your bank that shows up without you asking for anything follows the general rule: don't use it, and open the official app yourself.

How do I protect an older relative from this? With one sentence: "Don't pay for anything by scanning a QR code on the street; use the app you already have." Parking meters are a common point of contact. The NoCall blog has more phone-scam explainers you can share with them.

The summary fits in one line: a QR code is a link you can't read, so read it before you go in. Scan, look at the URL, and if it isn't the official domain, close it and go to the official channel yourself. That one-second pause takes the whole quishing scam apart.