QR codes on parking meters and in your inbox: how "quishing" works
QR codes are everywhere: restaurant menus, parking meters, parcel notices, two-factor setup screens. They are also a gift to scammers, because you can't read where a QR code goes before you scan it. Phishing through QR codes even has a nickname: *quishing*.
In December 2023 the Federal Trade Commission warned that scammers were hiding harmful links in QR codes, and the tactic has kept spreading since.
The common tricks
According to the FTC:
- Stickers over real codes. A fake QR code is stuck on a parking meter or sign. You "pay for parking" on a lookalike site that collects your card.
- QR codes in emails and texts with a made-up reason to scan: a failed delivery, a problem with your account, or "suspicious activity, change your password now".
A QR code can lead to a fake site that steals whatever you type, or try to install malware on your phone.
Why QR codes in email are especially sneaky
Email filters are good at checking links they can read. A QR code is an image: the link only appears when a phone camera decodes it. And the phone that scans it is often a personal device without the protections of a work laptop. So a message that would be caught as a link can slip through as a picture.
How to scan safely
- Unexpected QR code in an email or text? Don't scan it. Especially if it's pushing you to act fast.
- In public, check for stickers. A code stuck on top of another code, or on a meter that also has a payment app, deserves suspicion. Use the official app or website instead.
- Look at the address before opening. Most phone cameras show the web address first. Check the spelling and the domain.
- Never sign in or pay through a site you reached by scanning, unless you're certain it's the real one.
- Keep your phone updated and use multifactor authentication on important accounts.
If you are told your account has a problem, go to the company's site or app yourself, or call a number you already know.
At work
KnoxDefender's gateway looks at the whole message, not just its links: who really sent it, whether the sender passes authentication, whether the wording is a classic "account problem" or "delivery failed" lure. Our training includes a dedicated "QR-code phishing" course, with fictional examples, so people recognize the pattern on a parking meter and in their inbox.
Source
← All stories · Questions? Contact us.
Find out where your email is exposed.
Then close the gaps.
Answer a few questions and start a free trial in minutes, or grade your domain for free right now.