Quishing
Phishing using a QR code, which hides the destination URL behind an image that no security filter reads as a link.
A QR code is a URL you cannot read. That is the entire attack. It also defeats a lot of automated filtering, because an email scanner sees an image rather than a link.
The higher-risk version is physical: a sticker placed over the genuine code on a parking meter, an EV charger, a restaurant table or a parcel locker. Before scanning a code in the physical world, check whether it is a sticker over something else, and prefer typing the address or using the operator’s own app.
Where it shows up
- QR code scams — A QR code is a link you cannot read — which is why a sticker over a real one works so well.
- Phishing and smishing — A small, cheap problem and a link that fixes it — on a screen where you cannot see where the link goes.