Share This Article
Beware of QR codes: new digital risks
QR codes are now a part of everyday life: they are used for digital payments, viewing online menus and accessing services quickly.
It is precisely their widespread use that has made them an ideal target for cybercriminals. Among the emerging threats, quishing stands out as one of the fastest-growing online scams.
What is quishing and why it is dangerous
The term quishing comes from the combination of QR code and phishing. Unlike traditional fraudulent emails, in this case the deception is hidden within an apparently harmless image.
A QR code:
- does not display the destination URL before scanning
- can be easily created by anyone
- can be placed over an original one
- can change its content over time (dynamic QR codes)
This makes it difficult to detect, even for experienced users.
How a QR code works (and where the risk lies)
A QR code can trigger several actions:
- open a website
- initiate a payment
- download an app
- request credentials
- connect to a Wi-Fi network
The main risk is that the content is unknown before scanning, a feature that scammers exploit to deceive users.
Where fraudulent QR codes are hidden
Malicious QR codes can be found in various contexts:
- Public places
Parking meters, gas stations, and public transport stops are among the most exposed. - Emails and messages
Scammers use them to bypass spam filters. - Posters and advertisements
Fake posters or non-existent events easily attract scans. - Restaurants and venues
Digital menus can be replaced with fraudulent codes. - Physical mail
Even seemingly official letters may contain malicious QR codes.
The main QR code scams
The most common techniques include:
- QR phishing: cloned websites used to steal credentials
- Malware downloads: harmful apps disguised as updates
- QRLJacking: account theft via QR-based login
- Payment fraud: fake payment pages
How to recognize a suspicious QR code
To reduce risks, pay attention to:
- codes that are covered or applied with stickers
- QR codes out of context
- urgent or threatening messages
- offers that are too good to be true
- shortened URLs or ones similar to official domains
Always check the URL preview before opening it.
How to protect yourself from quishing
Before scanning
- ask yourself if it is really necessary
- verify the source
- physically check the code
After scanning
- do not enter sensitive data straight away
- avoid downloads from unofficial sources
- always verify the URL
Technical protection
- use your smartphone’s built-in scanner
- keep your system up to date
- install a reliable antivirus
- enable two-factor authentication
What to do if you have been a victim
In the event of a scam:
- disconnect your device from the internet
- change your passwords immediately
- contact your bank
- run an antivirus scan
- report the incident to the Postal Police
Conclusion
The problem is not QR codes but the careless ways in which they are used. Quishing exploits haste and trust but just a few seconds of attention can prevent even the most serious consequences.
Digital security starts with awareness: always verifying is the best defence.
