Wirebook

Wirebook › Glossary › Quishing

What is quishing (QR code phishing)?

In one sentence: Phishing with a QR code: a fake code, often a sticker over a real one, that leads to a page asking you to pay or log in.

A little more

Quishing (QR + phishing) is a trick where a QR code leads to a fake page that asks you to pay, log in or install something. Common versions are stickers over the real code on parking machines and charging points, codes in emails that get past link filters, and codes on fake delivery cards.

The defence is the same as for any phishing link: preview the address before opening it, read the real site name from the end of the address, look for a sticker on top of a printed code, and when money or a password is involved, type the address printed on the sign or one you already know.

See it in action

  1. BonusCan a sticker change where a QR code takes you?Build a QR code and colour its parts (corner finder squares, timing lines, alignment square, format notes, message), scratch it, tear it and stick a price label on it while a real decoder tries to read it at four levels of spare data, then be the sticker detective: preview where five pretend posters really go, compare with the printed address and spot the fake.8 min · interactive
  2. 16How can you spot a fake message?Sort a pretend inbox of real and sneaky fake messages from games, banks, parcels and friends.7 min · interactive

Do it for real

Free grown-up tools and guides on Tooltern, our sister site. They work in your browser and nothing is uploaded.

Related words

  • Phishing A fake message dressed up as someone you trust, sent to trick you into clicking a link or handing over a password, code or card.
  • QR code A square black-and-white pattern a camera can read, usually holding a web address; check where it goes before opening it.
  • Domain name The name part of a web address, like example.com, that a person or company owns. In a link, the owner is the part just before the first single slash.

← All 146 words