QR code glossary · Security
Quishing
Also called: QR code phishing, QR phishing
Definition
Quishing (QR code phishing) is a phishing attack that uses a QR code to send people to a malicious website, typically a fake login or payment page, often by sticking a fraudulent code over a genuine one or by putting a code in an email where link filters cannot inspect it.
How it works
A QR code holds only text, so scanning one cannot infect a phone by itself. The harm comes from the page it opens and what the victim does there: types a password, enters card details or installs an app. Attackers use QR codes because people trust them and cannot read them.
- Stickers over real codes on parking meters, charging stations, restaurant tables and posters, leading to a lookalike payment page.
- Codes in emails asking the reader to re-authenticate or fix an account. The code moves the victim from a computer, where security filters check links, to a phone, where they may not.
- Codes in letters, flyers and text messages that imitate a bank, a delivery company or a government service.
The FBI warned in January 2022 that criminals were tampering with QR codes to steal login and payment details, and the FTC warned in December 2023 about fake codes on parking meters and in messages. Short URLs make it worse, because the camera preview shows only the shortener’s domain.
Why it matters
For anyone scanning: read the address in the camera’s preview before opening it, be wary of codes stuck on top of other codes or arriving unexpectedly, and never enter a password or card number on a page reached through a code you did not expect. Pay through the official app or the terminal instead.
For businesses that print codes: place them where a sticker cannot easily cover them, or behind glass, and check them regularly. Print your domain under the code so people can compare it with the preview. Protect the account behind any dynamic codes with a strong password, because whoever controls it controls where every printed copy goes. Watch scan analytics per location: a code whose scans suddenly stop may have been covered.
In CirculateQR
Scans of each dynamic code are logged by time, approximate location and device, so a sudden drop at one placement stands out, and any code can be paused from the dashboard.
Related terms
- Short URLA short URL is a brief web address, such as example.com/r/A7K2Q9, that a server forwards to a longer destination; dynamic QR codes encode one so the printed pattern stays small and the destination can change without reprinting.
- Dynamic QR codeA dynamic QR code is a QR code that encodes a short link to a redirect service instead of the final content, so the destination can be changed after printing and each scan can be counted, for as long as the service keeps the link active.
- Single-use QR codeA single-use QR code is a code that a system accepts only once, such as an event ticket, coupon or one-time link, with the limit enforced by a server that marks the code’s ID as used, not by the printed pattern, which can be copied and scanned any number of times.
- RedirectA redirect is an HTTP response with a 3xx status code and a Location header that tells the browser to load a different address; it is how a dynamic QR code’s short link forwards each scan to the code’s current destination.
- Scan analyticsScan analytics are the records a dynamic QR code’s redirect service keeps each time the code is scanned, typically the time, an approximate location from the IP address, the device, operating system, browser and language, summarized into counts and charts.
Learn more
- QR code security: quishing and how to scan safely: Warning signs and what to do after a bad scan.
- QR code security features: One-time codes, gates and expiry dates.
Sources
Last updated . Written by the CirculateQR team; technical facts follow the sources listed above. Example codes and sizes are computed with the open-source qrcode encoder that CirculateQR uses. Spotted something wrong? Email support@circulateqr.com. QR Code is a registered trademark of DENSO WAVE INCORPORATED.
← Browse the full glossary