Technique
Quishing
Also known as: QR Code Phishing, QR Phishing, QR Code Scam
DELIVERY
QR code phishing using malicious codes on parking meters, restaurant menus, mail, or public signage to redirect to credential harvesting sites.
Common attack flows
How it fits in a scam
This technique shows up duringDELIVERY
Defense
How to defend against this
How to spot it
- QR code sticker appears placed over an existing code or looks tampered with
- URL preview shows misspellings or extra characters or unfamiliar domains after scanning
- Destination site requests login credentials or payment info unexpectedly
- QR code received unsolicited via email or text or mail or unexpected package
- Site lacks HTTPS or shows certificate warnings
- Urgency tactics like verify your account immediately or claim your prize
Further reading
FTC Consumer Alert
Official warning about QR code scams including parking meter fraud
Malwarebytes
Comprehensive overview of QR phishing tactics
Malwarebytes - Mail QR Codes
Real-world example of mail-based quishing delivering banking trojans
IBM
Analysis of quishing as emerging attack vector
BBB Scam Alert
Parking meter QR scam warning