QR Code Phishing (Quishing)

What is QR Code Phishing?

QR Code Phishing, commonly known as Quishing, combines the convenience of QR codes with traditional phishing techniques. Attackers create malicious QR codes that appear to be legitimate and place them in emails, posters, menus, advertisements or public spaces. When scanned, the code may redirect the user to a fraudulent website that looks like a trusted service.

Because QR codes hide the destination until they are scanned, users may not realize where they are being directed. A fake page might ask for an email address, password, payment information or other sensitive data. In some cases, the QR code may also lead to a malicious download or attempt to exploit vulnerabilities on the user's device.

To stay safe, avoid scanning QR codes from unknown or suspicious sources and check the URL carefully before entering any information. Be particularly cautious with QR codes placed over existing codes in public spaces. Keep your device and security software updated, and never assume that a QR code is safe simply because it appears on an official-looking poster or message.