Quishing (QR code phishing) is a social engineering cyberattack where attackers use QR codes on physical stickers, emails, or PDFs to redirect victims to credential-harvesting phishing websites.

Can scanning a QR code hack my phone automatically?

Scanning alone rarely executes code directly, but opening the resulting link can trigger drive-by malware downloads or trick you into entering passwords on fake login pages.

How can I verify if a QR code is authentic?

Inspect the decoded URL using a tool like TheScanQR before tapping open. Check the true root domain and ensure physical stickers have not been pasted over genuine signs.

CYBERSECURITY REPORT

Are QR Codes Safe? How to Spot Fake QR Codes and Avoid Quishing Scams

Scanning a QR code is technically safe because decoding the visual black-and-white matrix occurs locally, but opening the resulting link carries severe phishing (quishing) and credential theft risks. Attackers exploit QR codes because humans cannot read encoded URLs with the naked eye, bypassing traditional email spam filters and visual sanity checks.

What is Quishing and How Does it Work?

The term quishing combines "QR code" and "phishing". In corporate email environments, traditional email security scanners parse text links inside messages to detect malicious domains. However, when scammers embed the attack URL inside an attached image QR code, many legacy email gateways fail to decode it, allowing the malicious email straight into your inbox.

Common QR Code Attack Vectors

Physical Sticker Tampering: Scammers place fraudulent adhesive stickers directly over legitimate parking meters, restaurant menus, EV charging stations, and transit posters. When victims scan to pay, their payment details are harvested by a cloned payment portal.
Fake 2FA and Security Reset Notices: Phishing emails claim your corporate Microsoft 365, Google Workspace, or banking session has expired, instructing you to "scan this QR code with your authenticator app" to verify identity.
Malicious Wi-Fi Payloads: A QR code configured as WIFI:S:Free_Airport_WiFi;; can automatically connect your device to an unencrypted, rogue rogue access point designed to intercept unencrypted network traffic.

5 Golden Rules to Protect Yourself from Malicious QR Codes

1. Always Inspect Before Opening: Never allow your phone camera to open links automatically. Use TheScanQR to inspect the real root domain and check for warning signals.
2. Feel for Physical Stickers: Run your finger over QR codes printed on parking meters, restaurants, and retail terminals. If you feel a sticker pasted over the original sign, do not scan it.
3. Watch Out for URL Shorteners: Be suspicious of short links (such as bit.ly, tinyurl, or is.gd) in public spaces. Legitimate corporations typically display their full branded domain names.
4. Never Enter Credentials on Scanned Pages: If scanning a QR code leads to a password prompt or MFA code request, close the tab immediately and navigate to the official website manually.
5. Check for Punycode & Lookalike Domains: Scammers often register domains with substituted Cyrillic or Greek characters (e.g., pаypal.com where the 'a' is a Cyrillic character). TheScanQR automatically flags punycode spoofing attempts.