Quishing is the QR code scam you need to watch out for

• Banks and regulators have warned of the growing risk of quishing
• A type of phishing that uses fraudulent QR codes to steal information
• These malicious links aren’t easily recognized by users or email scanners

It’s not just suspicious links you need to watch out for in your email inbox: QR code phishing – or “quishing” – is becoming an increasingly common threat, with fraudulent codes designed to slip through security systems and fool you into surrendering your financial information.

A number of UK banks, together with the UK National Cyber Security Centre and US Federal Trade Commission, have recently warned of the dangers of these increasingly sophisticated quishing scams.

In a quishing attack, a QR code is usually sent as an attachment to an email. The email will appear to be from a legitimate source, such as a lender. When you scan the code, it will direct you to a malicious link. This will usually ask you to submit personal details, but it could also attempt to install malware or even capture an MFA token to bypass your login credentials.

What’s more, quishing attacks have now spread into the real world. Earlier this year, the RAC warned motorists of fraudulent QR codes being stuck to parking machines. When scanned, these would link users to a website that aims to steal the details and payment information of someone who believes they’re paying for parking.

These attacks have increased since the pandemic, when the use of QR codes ballooned. As a hands-free way to access everything from menus to medical forms, QR codes became a familiar and apparently trustworthy way to access information and services.

Gone quishing

Like a classic phishing scam, quishing aims…