Phishing

Phishing is an attack that uses fake websites or messages impersonating legitimate services to steal passwords, credit card numbers, and personal information. Phishing that uses QR codes rather than email or SMS is called quishing. The FBI issued a warning about QR code phishing in 2022.

One quishing method places a fake QR code sticker over a legitimate one. Scanning the fake code redirects to a convincing phishing site. Unlike email phishing, QR codes make it difficult to visually verify the URL before visiting, making victims less likely to notice the deception.

Three example defenses: check the URL displayed after scanning before proceeding; inspect QR codes for physical tampering (stickers layered on top); and avoid entering passwords or payment information on sites reached via QR code, instead accessing services through official apps or direct URL entry.