What Is Quishing? QR Code Scams and How to Spot a Fake QR Code
What is quishing? It's phishing through a QR code, and it works because you can't read a QR code with your eyes. Here's how QR code scams work and how to spot a fake QR code before you tap.
In quishing, a QR code replaces the suspicious link of ordinary phishing, so you don't see the destination until the page opens. The codes arrive by email, text, letter or flyer, or as stickers pressed over real codes on parking meters and signs, and the fake pages copy banks, delivery companies, parking payment sites and work logins. In January 2022 the FBI warned that criminals were tampering with QR codes, and in December 2023 the US Federal Trade Commission warned about harmful links hidden in QR codes. We cover the warning signs, how to check a link preview, and whether scanning a QR code can hack your phone.
You can read a link before you tap it.
You can't read a QR code.
Scammers know that, and it has a name.
Quishing is phishing through a QR code.
The code sends you to a fake website, built to steal your password, your payment details, or your personal information.
Some even try to install unwanted software.
With an ordinary link, you can read the address before you tap.
A QR code hides that link inside the pattern.
You don't see where it goes until the page is already open.
These codes turn up everywhere.
In emails, in text messages, in letters, and on flyers.
Or as a sticker, pressed right over real code, on a parking meter, a sign, or a poster.
And the page it opens looks familiar.
Fake pages copy banks, delivery companies, parking payment sites, and workplace logins.
This isn't new.
In January 2022, the FBI warned that criminals were tampering with QR codes to steal money.
In December 2023, the U.S. Federal Trade Commission warned about harmful links hidden in QR codes.
And fake stickers on parking pay stations have been reported in several cities.
So learn the warning signs, an email asking you to verify your account or to fix a delivery.
A sticker placed over a code, a text about an unpaid bill or a fine, and anything that pushes you to act right now.
Before you tap, read the link preview your camera shows.
Does the address match who it claims to be?
Treat an unexpected code like an unexpected link.
Never pay or log in from a code you didn't ask for.
When in doubt, skip the code.
Open the organization's own app or type their website yourself.
So can scanning a QR code hack your phone?
Scanning only reads the data.
The risk comes after when you open the link and then enter details, pay, or install something.
A code that clearly carries your brand with a link you control gives people more reason to trust it.
AriaQR turns any image into a QR code that still looks like your image, tested on real scanners before you pay.
Make yours at ariaqr.com.
A code that clearly carries your brand, with a link you control, gives people more reason to trust it.
