• Overview
    • Scam Map
    • Kill Chain
Recents

    Conversations will appear here

Technique

Quishing

Also known as: QR Code Phishing, QR Phishing, QR Code Scam

DELIVERY

QR code phishing using malicious codes on parking meters, restaurant menus, mail, or public signage to redirect to credential harvesting sites.

Common attack flows

How it fits in a scam

This technique shows up duringDELIVERY

Before

  • Data Breach HarvestingTARGETING
  • Social Media ReconnaissanceTARGETING
  • Data BrokersTARGETING

After

  • Malicious App InstallationCOMPROMISE
  • MalwareCOMPROMISE

Defense

How to defend against this

How to spot it

  • QR code sticker appears placed over an existing code or looks tampered with
  • URL preview shows misspellings or extra characters or unfamiliar domains after scanning
  • Destination site requests login credentials or payment info unexpectedly
  • QR code received unsolicited via email or text or mail or unexpected package
  • Site lacks HTTPS or shows certificate warnings
  • Urgency tactics like verify your account immediately or claim your prize

Tools you can use

  • DNS FilteringCost low · Effect high
  • Browser Security ExtensionCost low · Effect medium
  • Mobile Security AppCost low · Effect high

Steps you can take

  • Direct Source VerificationCost low · Effect high
  • Verify HTTPS ConnectionsCost low · Effect medium

Further reading

  • FTC Consumer Alert

    Official warning about QR code scams including parking meter fraud

  • Malwarebytes

    Comprehensive overview of QR phishing tactics

  • Malwarebytes - Mail QR Codes

    Real-world example of mail-based quishing delivering banking trojans

  • IBM

    Analysis of quishing as emerging attack vector

  • BBB Scam Alert

    Parking meter QR scam warning

Related techniques

Variants

  • Phishing Email

Same stage

  • Smishing
  • Vishing
  • Deepfake Voice Call
  • SEO Poisoning
  • Fake E-commerce Site
  • +15 more

Similar defense

  • Clipboard Hijacking
  • Malicious App Installation
  • Overlay Attack
  • Man In The Middle
  • Ad Network Tracking
  • +11 more