QR code phishing (quishing): what to watch for

The emergence of QR code phishing

QR code phishing, also known as 'quishing,' is a type of attack where a malicious QR code is used to lure victims to a fraudulent website. While QR codes have become a convenient way to access menus, websites, and apps, they also provide a perfect cover for cybercriminals. Because a human cannot read a QR code without a device, it is easy to hide a malicious link behind the visual pattern. This makes quishing a quiet and effective way to steal data.

For businesses, quishing is particularly dangerous because many security systems are designed to scan text and links in emails. A QR code is an image, which often allows it to bypass these automated filters and land directly in an employee's inbox. Once the email is opened, the user is encouraged to scan the code with their mobile phone, moving the attack away from the company's protected network and onto a personal device.

The popularity of QR codes exploded during the pandemic, and they are now used for everything from contactless payments to digital business cards. This widespread acceptance has created a 'blind spot' in many people's security habits. We have been trained to scan them without thinking, which is exactly what attackers are counting on.

How quishing works in practice

There are several ways attackers use QR code phishing: through digital messages and physical placements. Both methods rely on the victim's willingness to scan the code with their personal or work phone. Once scanned, the code takes the user to a site that looks legitimate but is controlled by the criminal.

• Email-based Quishing: An email claiming you need to 'scan this code to reset your MFA' or 'view a secure document' from a vendor.
• Physical Quishing: Stickers placed over legitimate QR codes on parking meters, public charging stations, or restaurant tables.
• PDF Attachments: A malicious QR code inside a PDF that purports to be a company policy update or an urgent invoice.
• Phony Promotional Posters: Flyers in public places offering a discount or a prize if you scan the code and enter your details.

Why QR code phishing is so effective

Quishing exploits a 'security gap' between devices. When an employee scans a QR code on their work computer using their personal phone, the security controls on the computer are completely bypassed. The phone then opens a browser that may not have the same protections as the corporate network, making it easier for the attacker to steal login credentials, personal data, or credit card numbers.

Additionally, because the scan happens on a mobile device, the screen is smaller and the browser's address bar may be hidden. This makes it much harder for the user to notice that they are on a fake website. The attacker can use this lack of visibility to create a very convincing imitation of a real login portal.

How to stay safe when scanning QR codes

You don't need to stop using QR codes entirely, but you should treat them with the same caution as a link in a suspicious email. Educating your team on these safety steps is essential for protecting your business and personal information.

1. Before scanning a physical QR code, check for signs of tampering, such as a sticker placed over an original code or uneven edges.
2. Use your phone's native camera app to scan, as most will show a preview of the URL before you click to open it.
3. If a QR code takes you to a login page, do not enter your credentials. Go to the official website through your browser instead.
4. Avoid downloading apps via a QR code; always use the official Apple App Store or Google Play Store for new software.
5. Be suspicious of QR codes in emails that could have been sent as a plain link. There is usually no legitimate reason to use a QR code in an email.

Action steps for business owners

As a business owner, you should ensure that your employees understand that QR codes are just another way to deliver a link. They should be handled with the same security protocols as any other digital communication. A single bad scan can lead to a data breach that affects your entire company.

• Include quishing examples and safety tips in your regular cybersecurity awareness training for all staff.
• Discourage employees from using QR codes to access internal company systems or to perform security-sensitive tasks like MFA resets.
• If your business uses QR codes for customers, regularly inspect them to ensure they haven't been replaced by attackers.
• Encourage employees to use a dedicated 'secure' QR scanner app that checks links for known threats before opening them.