What quishing is
Quishing is phishing with a QR code. A phishing page copies a real site to steal your password or your card details. A QR code hides the address, so you cannot see where the link goes until you scan it.
Criminals use this in a few ways. They stick fake codes over real ones on parking meters, charging stations, menus and flyers. They also put codes in emails, because a code in an image can get past filters that check text links.
The code itself is not the danger. The danger is the page that it opens, and what you do on that page.
A fake page often looks the same as the real one. It may ask you to sign in, to confirm a payment or to enter a code that was sent to you. A real parking meter or menu rarely needs more than a payment you start yourself.
How to check a QR code before you open it
These five steps take less than a minute.
- Look for a sticker. Check if a sticker covers the printed code. Criminals stick fake codes over real ones.
- Read the address in the preview. Your phone or scanner shows the link before it opens. Read the whole address.
- Check the spelling of the domain. Look for a changed letter, an extra word or an odd ending. The domain is the part before the first single slash.
- Do not enter a password or a card number. If a code opened the page, use the official app or type the address yourself before you sign in or pay.
- Use a safety check for codes you do not trust. A safety check tests the link against a list of known bad sites before the page opens.
You can also check a code that sits in a picture. Our guide on how to scan a QR code from an image explains how.
What the QR Code Scanner safety check does
The safety check is a Pro feature. When you scan a code that holds a link, the app sends the link to Google Web Risk. Google Web Risk keeps lists of sites that Google marks as unsafe.
If Google lists the site for phishing, malware or unwanted software, the app shows a warning before the page opens. You can then close the result and stay safe.
A clean result is not a guarantee. A new bad site may not be on the list yet. Keep reading the address yourself.
Pro starts with a 3-day free trial. Free includes scanning, so you can still read any code and see its content first. To compare scanners, read our guide to the best QR code scanner app.
What a QR code cannot do
A QR code holds text. That text can be a web link, a phone number, a Wi-Fi login or a message. The code cannot run a program on its own.
On an up-to-date phone, scanning shows you the content first. The risk starts when you do something with it:
- You open a link.
- You join a Wi-Fi network that the code names.
- You send a message or make a call that the code prepared.
This is why a short pause helps. Most phones ask you to confirm before they join a network or start a call. Read that prompt. If the name of the network or the number looks wrong, cancel.
Read what the code wants to do before you accept. The same rule applies to product codes. See the barcode scanner page for how those differ.
Common mistakes
- You trust a code because it is in a public place. Anyone can put a sticker on a sign.
- You pay through a page that a code opened. Open your bank or the official app yourself.
- You ignore a misspelled domain. A small change in a name is a common sign of a fake site.