Quishing fraud uses manipulated QR codes to steal data

Criminals are increasingly using a fraud method known as ‘quishing’ to steal sensitive information, such as login credentials and banking details, through manipulated QR codes. Attackers often overlay legitimate QR codes at public locations like parking meters, electric vehicle charging stations, or restaurant entrances with professional-looking stickers that mimic well-known brands or payment services.

While scanning a code typically does not cause immediate financial damage, danger arises when users are directed to fraudulent websites and subsequently enter personal data, install malicious files, or confirm transactions. To protect against these scams, experts recommend inspecting the URL displayed on a smartphone before opening it, using apps with preview functions, and opting for direct app access rather than scanning codes when possible. Physical signs of tampering, such as stickers placed crookedly or over existing codes, should also serve as warnings.