What Is Quishing? How to Protect Yourself from QR‑Code Phishing

QR codes are everywhere—menus, tickets, payments, parking meters. They’ve become a part of daily life. But in 2025, that convenience is being exploited in a dangerous new way.

Quishing, short for QR-code phishing, is a fast-growing cybersecurity threat where attackers use QR codes to lead you to malicious websites or trigger actions that compromise your privacy and data. And unlike typical phishing emails, these attacks happen in the physical world—making them even harder to spot.

What Exactly Is Quishing?

Quishing is a form of phishing attack where a QR code is used to trick a user into visiting a fake or malicious site. From there, attackers may try to:

Steal login credentials
Install malware
Harvest payment details or personal information

What makes it especially dangerous is that users often scan QR codes without thinking—trusting that the source is legitimate just because it’s printed on a poster, a business card, or a restaurant menu.

“Quishing works because it hijacks trust in physical objects—and most people never question it.”

How a Quishing Attack Works

Here’s a basic scenario:

An attacker prints a QR code that links to a fake website (e.g. a cloned login page).
They place it on a public poster, a restaurant table, or over an existing QR sticker.
You scan the code, visit the page, and unknowingly enter sensitive info.
Your credentials are stolen—or worse, malware is silently installed.

These attacks are low-tech but highly effective because they exploit human behavior, not technical vulnerabilities.

Real-Life Examples of Quishing

Fake Parking QR Codes: Some cities have seen scammers place fake QR stickers over real parking meters. Victims paid fines to fraudulent accounts.
Café Menus: An attacker replaces a restaurant’s menu QR code with one leading to a malware-infested site disguised as the original.
Event Check-ins: Hackers place fake check-in posters at tech conferences to harvest credentials from attendees scanning them.

Why Quishing Is on the Rise in 2025

Several factors have accelerated this trend:

QR codes are mainstream: Used in marketing, payments, sign-ins, and more.
No built-in URL preview: Many scanners immediately open the link, removing friction—but also removing caution.
Hard to police in public: Anyone can slap a fake QR sticker on a poster or table without raising suspicion.

Cybercriminals love these conditions because it takes minimal effort to launch a campaign.

How to Spot a Suspicious QR Code

You can’t tell by looking at the code itself, but there are warning signs:

The QR is on a sticker that seems out of place or covers another code.
It lacks context or explanation (“scan to win!” with no details).
After scanning, the domain looks strange (e.g. g00gle.support-login.co).
The website asks for sensitive info immediately (login, credit card, etc).

Pro Tip: Modern camera apps often preview the URL before you click — use that moment to double-check where it’s taking you.

How to Protect Yourself from Quishing

1. Use a Secure QR Scanner App

Standard camera apps auto-launch URLs. Instead, use scanners that show the full destination link and scan for known threats:

Norton Snap QR Code Reader
Trend Micro QR Scanner
Kaspersky QR Scanner

2. Preview URLs Before Clicking

If your phone doesn’t preview QR links, avoid clicking automatically. Better yet, manually enter the domain if it’s visible.

3. Watch for Stickers and Tampering

If a QR code looks like it’s been taped or stuck onto an existing object, be suspicious. Restaurants, events, and shops should use permanent signage—not sticky labels.

4. Use a Mobile Browser with Phishing Protection

Install browsers like:

Brave: Blocks trackers and shows safe browsing warnings
Firefox: Has built-in phishing protection
DuckDuckGo Browser: Privacy-first and minimal tracking

5. Keep Your Phone’s Security Tools Updated

If you have antivirus or mobile security software, make sure it’s active and updated. Many now detect known malicious sites—even if you reach them through a QR.

6. Educate People Around You

Most quishing attacks rely on someone letting their guard down. Share this with coworkers, family, or anyone who uses QR codes regularly. Awareness is half the defense.

Final Word: QR Codes Are Useful — But Not Innocent

Quishing isn’t about fear—it’s about awareness. QR codes can be a great convenience, but just like email links or shortened URLs, they can be weaponized.

In 2025, our best defense is caution. Don’t scan codes blindly. Don’t click links you don’t recognize. And don’t assume a sticker on a wall is safe just because it’s in a familiar place.