What is quishing? The fake QR code scam

You sit down at a restaurant table, spot the usual QR code stuck in the corner, scan it to see the menu or pay the bill, and get on with your life. The problem is that, more and more often, that sticker isn't the original — it's another one, pasted on top, pointing at a payment that doesn't go to the restaurant. The scam has a technical name: quishing, "QR code" welded to "phishing". And it exploits exactly what makes QR codes convenient: nobody sees the destination before scanning.

What quishing is

What is quishing, exactly?

Quishing is phishing done through a QR code: instead of sending a suspicious link by email, the scammer hides the malicious link inside a QR code image, counting on the fact that nobody can read it — only scan it — to find out where it leads.

The difference from traditional phishing isn't merely cosmetic. A text link can be inspected: you hover over it, see the domain, notice that "yourbank-secure.net" isn't your bank. A QR code gives you no preview. The camera reads the code, the phone opens the browser or the payment app, and only at that moment — after the process has already started — does the destination become visible. Research from Check Point shows a roughly 900% jump in email quishing attacks between 2021 and 2024, and QR codes now appear in more than 10% of the phishing emails the company analyses. A good part of corporate antispam filtering was trained to scan text, not to decode a QR code image and analyse the link hidden inside it — and that gap is exactly what the scam exploits.

How the scam reaches you

Outside corporate email, the most common version is physical and tied to instant payments. In Brazil, local press reports have been documenting the same modus operandi repeating in different cities through 2025 and 2026:

• Sticker over sticker: the scammer pastes a fake QR code on top of the legitimate one on parking meters, restaurant tables, self-service kiosks and even in hospitals. Whoever pays thinks they're paying for parking or settling the bill — in practice, they've just transferred money straight into the criminal's account.
• A bill with a swapped QR code: the image on the printed bill is manipulated and the QR code (which is technically an instant payment too) is replaced. The critical difference here is that instant payments have no clearing window like a traditional bank transfer — the money leaves immediately, with none of the delay that would normally let you spot the mistake and cancel.
• Cloned login QR code (QRLjacking): an older variant, documented by ESET, in which the scammer clones the WhatsApp Web login QR screen on a fake site. The victim scans it thinking they're opening the real WhatsApp Web and, without realising, authorises the attacker to open a parallel session with access to their conversation history.

One important correction, to avoid the alarmist reading: simply pointing your camera at a malicious QR code does not drain your account on the spot. The scam only works if you complete the action afterwards — confirming the payment, opening a fake site and typing a password, or installing an app. That next step is where it's worth putting the brakes on.

Why this scam is growing

Quishing hitched a ride on two habits that became the norm after the pandemic: digital menus via QR code and instant payments as the dominant way to pay. In Brazil, banking federation Febraban recorded more than 24 million people falling victim to fraud involving instant payments and printed bills between July 2024 and June 2025 — a figure that mixes several types of scam, not only quishing, but one that shows the size of the attack surface around those two payment methods. On the corporate side, Abnormal Security reported growth of around 400% in QR code attacks between 2023 and 2025. The pattern is the same in both worlds: the scam takes advantage of a gesture that has become automatic — scanning without thinking.

How to check a QR code before you pay

The good news is that almost all of this scam can be neutralised with one simple habit, using something that already exists inside your own banking app:

• Check the recipient's name and ID number that the app shows before you confirm the payment. Febraban calls this the last layer of security — it's the piece of data the scammer can't forge inside your application. If the name doesn't match the business (an individual in place of a registered company, for example), cancel.
• Look at the sticker carefully before scanning: peeling layers, visible glue, a QR code sitting crooked inside the printed frame, or a sticker that clearly didn't come from the same print run as the rest of the sign are all signs that someone has pasted something over the top.
• Distrust QR codes on flyers, lampposts or donation boxes without clear official identification — that's the scenario where swapping in a sticker is easiest and least likely to be noticed.
• Remember that no bank asks for a QR code or a copy-and-paste payment string as a "security verification" or a "details update". That request, in any context, is a sign of a scam.
• With login QR codes (WhatsApp Web and similar), only scan from the official site or app — never from a link sent to you by someone else.

If you fall for it anyway, the route is to contact your bank immediately and ask for a fraud recall — in Brazil, the central bank's Special Return Mechanism (MED) exists to try to claw back a fraudulent instant payment — and to file a police report. The chance of recovery drops fast with time, so the sooner you act, the better.

The habit that solves most of the problem

Quishing doesn't depend on any software flaw to work — it's pure social engineering, much like the "hi mum" WhatsApp scam: it exploits an automatic gesture, not a technical vulnerability. Which is why the defence isn't installing a program either — it's checking the recipient's name before confirming any payment, the same way you'd distrust a strange link arriving by message. That same principle — distrust the channel before trusting the credential — is what makes attacks like MFA fatigue and SIM swap effective, and it's also why technologies such as passkeys keep gaining ground: the less security depends on "is this legitimate?" decided under pressure, the better.