Quishing: The New QR Code Scam Redirecting Victims to Fake Websites

Quishing is a cyberscam where malicious QR codes are placed over legitimate ones to redirect users to fake websites designed to steal personal or banking information. The scam is difficult to detect because the website URL is hidden when accessed via QR code, making it a growing threat in public spaces and through postal communications.

What is Quishing?

Quishing (QR Code Phishing) is a cyberscam where criminals place malicious QR code stickers over legitimate ones. When victims scan the fake code, they are redirected to a fraudulent website that mimics the real one, tricking them into entering personal or banking information.

How the Scam Works

The Technique

Malicious QR codes are carefully placed to be as inconspicuous as possible. When scanned, victims are directed to a fake website that looks identical to the genuine one. The key advantage for criminals is that when accessing a site via QR code, the URL is hidden from view, making it nearly impossible for users to detect the fraud immediately.

Common Placement Methods

Stickers placed on posters or public signage
Fake traffic violation or parking fine notices
Fake postal delivery or parcel collection notices placed in mailboxes

How to Protect Yourself

Prevention Tips

Inspect QR Codes Carefully: Before scanning, examine the QR code closely. Look for stickers, tears, or anything that appears out of place or recently added.
Verify the URL: After scanning, check the website's URL in your browser before entering any information. Legitimate companies will use their official domain names.
Type URLs Directly: For important transactions or sensitive information, bypass QR codes entirely and type the official URL directly into your browser.
Verify Suspicious Notices: If you receive an unexpected traffic ticket, parking fine, or postal notice with a QR code, contact the issuing authority directly using a phone number or website you find independently.

Reporting Suspicious QR Codes

If you discover a fraudulent QR code in a public place, report it to: suspect@safeonweb.be

Key Takeaway

Quishing exploits the convenience of QR codes to commit fraud. Always exercise caution when scanning QR codes, and never enter personal or financial information on a website accessed through a QR code without first verifying the legitimate URL through other means.