Quishing: The QR Code Scam That’s Fooling Everyone — And How to Outsmart It

Picture this:

You’re at a coffee shop. You scan the QR code taped to the table — “View our menu.”

Your phone opens a website that looks like a typical food ordering page.

The branding’s clean. The layout’s familiar. Then, it asks you to “verify” with your Google login. You think nothing of it — just a few taps and you’re in.

But the next day, your Instagram’s locked. A few hours later, your email won’t load.

You didn’t download anything weird. You didn’t click on any suspicious links.

All you did was scan a QR code.

Welcome to the world of Quishing — a fast-growing scam that’s catching smart people off guard every single day.

So… What Is Quishing?

Let’s break it down.

Quishing = QR code + phishing.

It’s when a scammer hides a malicious link behind a QR code. You scan it, and it takes you to a fake site — one that might ask for your login info, payment details, or access permissions. But behind the scenes? They’re stealing your data, hijacking your sessions, or injecting malware onto your device.

What makes it dangerous is how normal it feels.

QR codes are visual. You can’t hover over them like a normal link to see where it leads. And because we’ve gotten so used to scanning without thinking, attackers have started exploiting that muscle memory.

Why Is This Suddenly a Big Deal?

QR codes are everywhere now — and that’s not an accident.

During the pandemic, businesses turned to contactless tech to reduce risk. According to McKinsey, QR code usage surged more than 750% between 2020 and 2022. Today, they’re on menus, delivery boxes, invoices, gym signs, street posters — basically any flat surface you can think of.

And attackers? They’re adapting faster than most people realize.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued alerts in 2023 highlighting how quishing attacks often bypass email filters, because the link isn’t in the email body — it’s in an image. That means even well-secured inboxes aren’t catching them.

Security firm Proofpoint reported a 600% spike in QR-based phishing campaigns in just 12 months. The targets range from regular consumers to corporate employees.

Long story short: if you’re online and have a phone, this affects you.

Real-World Quishing in Action

This isn’t just a “what if” scenario. Here are three common ways it plays out in real life:

1. The Fake Delivery Notice

You get an email or text saying your package couldn’t be delivered. There’s a QR code to reschedule. You scan it and land on what looks like a legit FedEx or UPS page. It asks you to log in or pay a redelivery fee — but the whole site is fake. Your info is stolen the moment you type it.

2. The Menu Swap

At a restaurant, the real QR menu is covered by a sticker with a fake one. You scan it, expecting lunch. Instead, it takes you to a phony order page that asks for your name, number, and payment details — all of which go straight to the attacker.

3. The Event Flyer Trap

You see a poster for a local concert or student event. There’s a QR code for discounted tickets. But the site you land on is a near-perfect copy of a real platform, built to trick you into handing over card info.

These examples have been documented by experts at Trend Micro, ENISA (European Union Agency for Cybersecurity), and other security orgs tracking the rise of QR-based attacks.

How to Outsmart Quishing Attacks

Here’s the good news: once you know what to look for, these scams are surprisingly easy to avoid.

1. Preview the link before opening it.

Some phones show a preview. If yours doesn’t, try a QR scanner app that does. Never open a link blindly.

2. Never log in through a QR code.

If a scanned link takes you to a login page — even one that looks like Google, Microsoft, or Apple — don’t do it. Open your browser and go to the site directly.

3. Check the domain name.

Look closely. Misspelled brand names, gibberish URLs, or weird-looking extensions (like .xyz or .top) are all red flags.

4. Inspect the physical code.

Is it a sticker slapped onto a menu or poster? Does it look like it’s covering something up? If it feels sketchy, trust your gut.

5. Keep your phone updated.

Some attacks rely on known bugs in outdated software. Just keeping your OS up to date can close off a bunch of entry points.

Why This Matters More Than You Think

We usually think of cybersecurity as something that lives in code, firewalls, or giant corporations. But the truth is, most hacks start small — with a trick, a mistake, or a moment of trust.

That’s what makes quishing so dangerous: it doesn’t feel dangerous.

And that’s also why HackWard exists — to make digital safety make sense. To break down the threats that don’t get talked about enough, and give you the tools to deal with them confidently, not fearfully.

If you’ve come across a weird QR code recently — maybe one on a flyer, in an email, or just something that didn’t sit right — send it my way. I’m collecting examples for a future HackShield post where we’ll analyze what’s legit and what’s not, together.

Stay sharp out there. Awareness beats panic, every single time.

— Pranav

Founder, HackWard