QR Code Phishing (Quishing)

A QR code is only a picture of a web address. Your phone reads the picture and opens the page. You cannot see where it goes until you are already there, and that gap is the whole attack. QR code phishing, often called quishing, means putting a bad code where people expect a good one.

The sticker is the trick. Someone prints a code on cheap vinyl and sticks it over the real one on a parking meter, a restaurant table, a charging point or a printed invoice. The page that opens looks like the payment screen you were expecting. The driver pays for an hour of parking and hands over a full card number at the same time. The meter is untouched, so nobody notices for weeks.

A phone hides the one thing that would save you. The address bar is short, the page fills the screen, and a long address is cut in the middle. A name like pay-parking-city.co is easy to accept when it is the only part you can read. On a laptop many people would have paused over it. On a phone there is nothing to pause over.

Two checks take five seconds. Run your thumb over the sign before you scan, because a sticker laid on top of a sticker has an edge your nail will catch. Then read the address your phone shows and look only at the last two words before the first slash. That part says who really owns the page. Everything in front of it can be typed by anyone.

Businesses make the problem worse without meaning to. Print a code that leads to some random payment link and you have taught your own customers to scan and pay without thinking. Print the plain web address under the code instead, on your own domain, and never put a code on a document that asks for money. When Linkysoft builds a site in a website design project, payment pages live on the main domain for that reason.

If someone has already scanned a code and typed card details, treat it as a stolen card rather than a mistake. Call the bank, cancel it, and check the statement for a small test charge of one or two pounds. Linkysoft's cybersecurity team is asked about printed codes far more often than about passwords now.