What Is Quishing? How to Avoid QR Code Scams

What Is Quishing?

Quishing, or QR code phishing, is a scam in which a cybercriminal sends a fake QR code (or replaces a legitimate one) that leads to a phony website or infects your device with malware. If routed to a fake website, you'll likely be asked to enter personal information the scammer may use in the hopes of stealing your ID or intercepting a payment.

How Does Quishing Work?

Quishing scams can vary, but here's the general process fraudsters use:

1. A scammer creates and shares a fake QR code. Creating a QR code is simple and often free to do. After creating a new code that leads to a fake or phony website, the scammer shares it with potential victims. They might enclose it in a package or letter, place it over legitimate codes in public places or send it in an email or text message.
2. A victim scans the QR code. Thinking they're scanning a legitimate QR code, the victim gets redirected to a fake website that may impersonate a secure one. Once there, the victim will typically be asked to provide personal information, and often, there's some type of urgency involved.
3. The victim shares personal information. If the victim does share personally identifiable information, the scammer can use it to hack their accounts, reroute money or steal their identity.

Be aware: QR codes are particularly enticing to scammers because they're unreadable until you scan them. Unless you can tell that a code has been tampered with, such as by being covered by a different QR code with a sticker, QR codes themselves don't look suspicious.

Examples of Quishing

Knowing some examples of quishing may help you be more cautious around QR codes. Here are some scenarios to look out for:

• Parking meters: Scammers may place phony QR code stickers on parking meters, directing you to fake websites rather than legitimate parking apps or websites.
• Restaurant menus: Post-pandemic, QR codes are common on restaurant tables. Scammers might replace them or cover them up with codes leading to malicious websites.
• Unsolicited packages or cards: In what's known as a brushing scam, fraudsters send unexpected packages to victims that contain a card with a QR code. The card prompts recipients to scan the code to find out information about the product or who sent it.

In addition to these specific scams, be wary of QR codes you see in emails, text messages, social media posts and those shared in public places.

Who Is Most Vulnerable to Quishing Attacks?

Anyone with a smartphone can fall victim to a quishing attack, but certain demographics and behaviors can make you more vulnerable, including:

• Online shoppers: If you're a frequent online shopper, packages at your door probably don't garner much attention. This could make you more likely to open mail without questioning where it came from.
• Travelers: When you travel, you're likely visiting restaurants, using public transportation or paying for parking meters. All of these situations—especially when you're in a hurry or in an unfamiliar location—can make you more vulnerable to quishing scams.
• People with less technological experience: Anyone who's less familiar with technology and, specifically, QR codes, may be more likely to become a victim of a quishing scam.

How to Protect Yourself From Quishing

Use the following tips to help you spot a quishing scam before it's too late:

• Be skeptical. Don't trust any QR code—only scan those provided by a person or business you trust.
• Look for tampering. Take a close look at QR codes in public areas, such as on parking meters or restaurant tables. Keep an eye out for signs of tampering, like stickers placed over existing signage.
• Check URLs. When you scan a QR code and see a URL pop up, make sure it looks authentic. If it's short, unreadable or has spelling errors, take caution. Also check for a padlock symbol and the letters "https" in the URL.
• Beware of phony websites. Even if the URL looks OK, be sure the website looks legitimate too. Again, look for misspellings and typos.
• Don't download apps using QR codes. If a QR code prompts you to download an app, don't—it could be malicious. Instead, find the app by searching it in your device's app store.
• Use your phone's camera. When scanning a QR code, use your phone's camera. Scanning apps you download could make it more likely you'll download something dangerous.
• Be careful with your data. If a QR code takes you to a website that asks for sensitive information, such as your credit card number or login credentials, don't engage.
• Install security software. Make sure your phone uses security software to prevent viruses and malware, and make sure to keep it updated.
• Avoid scanning QR codes found in unexpected mail. If a QR code arrives in the mail from an unknown sender, resist the urge to scan it.
• Treat urgency like a red flag. If a person, email or website prompts you to act fast to avoid a potential consequence, it's probably a scam.

What to Do if You Scan a Fake QR Code

If you think you've scanned a fake QR code, take the following steps as soon as possible:

1. Change your passwords. If you think any of your accounts have been compromised, change those passwords right away.
2. Contact financial institutions. If you think you've been a victim of QR code fraud, notify your banks and credit card companies. They may need to freeze or close any compromised accounts.
3. Consider setting up fraud alerts or freezing your credit. At any point, you have the right to set up fraud alerts or freeze your credit with the three credit bureaus—Experian, TransUnion and Equifax—at no cost. Fraud alerts instruct companies to verify your identity before extending new credit, and freezes limit access to your credit report.
4. Report the incident to the Federal Trade Commission (FTC). If a quishing scam has resulted in identity theft, report it to the FTC using the agency's website. Doing so can help law enforcement learn more about these scams.
5. Alert the business or location where the incident occurred. If you were scammed by a QR code in a business, alert management so they can remove the fake QR code.

The Bottom Line

Unfortunately, anyone who uses QR codes can fall victim to quishing scams. But knowing how these scams work, understanding common examples and learning potential signs of quishing can help you avoid a dangerous situation. Use caution when scanning any QR code, and beware of websites and URLs that look fishy.

You may also want to consider identity theft protection from Experian. This service monitors your credit report and alerts you to changes, provides a dark web surveillance report, performs a free privacy scan to help identify signs of fraud and more.