How to Protect Yourself from Fake QR Codes (Quishing)

QR codes are easy and fast, which is why attackers like them too. In "quishing", a fake QR code takes the user to a phishing page or a malicious site. The good news is that a few habits reduce the risk a lot.

How does the attack work?

The attacker sticks their own code over a legitimate QR code, or sends a fake code by email or message. The person who scans it lands on a fake page that looks like a bank or a familiar service and enters their details there.

Checklist before scanning

• Is the code in a trustworthy place? Is there a sticker or a shifted layer on top of it?
• Be suspicious of codes in emails or messages from unknown sources.
• Do not trust messages that pressure you with urgency ("your account will be closed").

After scanning

• When your phone shows the address, read all of it. Is the domain familiar?
• Be extra careful on pages that ask for login details, card numbers or verification codes.
• If in doubt, close the page and contact the organization through channels you already know.

Tips for people who share QR codes

• Show your codes in safe places you can check.
• Use a short, familiar address; long, complicated addresses raise suspicion.
• Write who published the code and what it is for next to it.
• Check printed codes regularly to see whether something has been stuck on them.

Security at Kısaltıcı

Kısaltıcı’s terms of use prohibit redirects to phishing, malware and deceptive content, and such links can be disabled. Before clicking a short link you do not know, always think about who sent it.