Quishing: scams with QR codes and links in SMSs

Quishing: scams with QR codes and links in SMSs

You scan a QR code and your cellphone opens a website straight away. You have not read an address, typed anything or decided where to go: the QR code decided for you. That convenience is exactly what quishing (QR + phishing) exploits: QR codes and short links that hide where they lead, to take you to fake websites that steal your details or your money.

Quishing is not a separate technique from smishing (like the fake traffic-fine SMS): it is the same trick with the link better hidden. A fake fine or parcel SMS still lets you spot a suspicious domain if you look carefully; a QR code shows you nothing until you have already scanned it.

Where fake QR codes show up

• Parking signs and pay points. A sticker with a fake QR code placed over the real one from the municipality or the official parking app. You scan it, land on a site that imitates the parking payment page and enter your card details.
• Restaurant tables and bills. A QR code stuck over the original. Where you pay by scanning a code with an app such as SnapScan or Zapper, a fake sticker can send your money to someone else; other fake codes push you to install an app or take you to a phishing site on any pretext.
• Fines and notices on the windscreen. Fake traffic-fine notices with a QR code "to pay at a discount". The same hook as the fake fine SMS, on paper. A real fine can be checked with the authority that issued it: the Road Traffic Infringement Agency (RTIA) for AARTO fines, or your municipal traffic department.
• Parcels and deliveries. QR codes on stickers or in SMSs ("scan to rebook your delivery"), a variant of the parcel scam.
• Emails and SMSs with a QR code. The message asks you to scan a code instead of tapping a link, sometimes with the excuse of "two-step verification" or "security". It also gets past anti-phishing filters, which check links but not images.
• Cryptocurrency and payments. QR codes that supposedly contain a payment address or a "refund". Once the money is sent, there is no way back.

The rule: look at the destination before you open it

With a normal link you can read the address before you tap. With a QR code you cannot, so you have to add that step yourself:

1. Scan, but do not open it yet. Most cellphones show the full web address before opening it. That is the moment to decide: read all of it, without rushing.
2. Check the domain. It must be the official one for that service, with no extra hyphens or strange endings. If the parking QR code takes you to a domain that is not the municipality's or the official app's, it is fake. In a payment app, check that the name it shows is the business you are actually paying before you approve anything.
3. If something does not add up, do not go in: go to the official channel yourself. Open the official parking, bank or shop app and do it there. It is the same method we use to check a call or SMS from your bank.
4. Be wary of QR codes that rush you. "Scan now", "final notice", "your parcel goes back today". Urgency is the signature of fraud, on a QR code just as in an SMS.

And a practical tip for QR codes in public places: check whether one sticker has been stuck over another. If the code is on a sticker that looks added later, or covers another code underneath, do not use it. Pay from the official app you already have installed.

What to do if you already scanned and gave details

• You entered your card on that site: call your bank's fraud line now (the number on the back of your card), block the card and ask for a new one. Watch your account over the coming weeks.
• You downloaded an app from the QR code: uninstall it, run your cellphone's antivirus and check the permissions you gave it (SMS, accessibility and notifications are the dangerous ones).
• You only scanned and closed it: almost certainly nothing happened. Scanning on its own installs nothing and gives away no details; the risk starts when you interact with the website.
• Open a case at your nearest police station (SAPS) with photos of the QR code (if it was in a public place, a photo of the sticker and where it was) and screenshots of the website, and ask for the case number.
• If the QR code reached you by SMS or in a call, report the number in the spam numbers directory.

Quick questions

Can scanning a QR code hack my phone? Scanning on its own, no: a QR code only contains text (usually a web address). The danger is the website it takes you to and what you do there: entering details, downloading files or granting permissions. That is why the defence is to check the destination before you open it.

Are short links (bit.ly and the like) the same thing? The same problem, yes: they hide the destination. Some legitimate link shorteners let you preview the address (many by adding a "+" at the end), but the practical rule is the same: if you do not know where it leads and it pushes you to tap, do not tap; go to the official channel yourself.

Can my bank send me a genuine QR code? Yes, for example to link the app or confirm a transaction... as part of a process that YOU started. A QR code "from the bank" that arrives when you asked for nothing follows the general rule: do not use it, and open the official app yourself.

How do I protect an older person from this? With one sentence: "never pay anything by scanning a QR code in a public place; use the app you already have". You will find more advice on our blog.

The summary fits in one line: a QR code is a link you cannot read, so read it before you open it. Scan, look at the address, and if it is not the official domain, close it and go to the official channel yourself. That one second of pause defeats quishing completely.