It looked entirely official. Same shade of green as the machine, same typeface, a line about contactless payment, and a code in the middle.
It was printed at a copy shop for about forty pence and stuck on top of the real one.
People paid. Card details went to somebody who was not the council, and the first anyone knew about it was a run of fraudulent charges a fortnight later. Councils across several countries have now issued warnings about exactly this, and the same trick has appeared on electric vehicle chargers, restaurant tables, and parcel delivery notices.
The attack has a name now: quishing. Phishing, but through a code.
Why the format is vulnerable
A QR code is not readable by humans. That is the entire vulnerability, and no amount of technology fixes it.
When you receive a suspicious email, you can hover over the link and see that it points somewhere ridiculous. That instinct, built up over twenty years, is what protects most people most of the time. A code removes it completely. The destination is invisible until you have already scanned, and by then the page is loading and it looks exactly like the site you expected.
There is a second problem. Codes get scanned on phones, and phones are worse for this. The address bar truncates long URLs, the screen is small, people scan while walking or queuing, and the whole interaction is designed to be fast. Speed is the enemy of scrutiny.
And email security filters, which catch a good proportion of ordinary phishing, largely cannot read what is inside an image of a code. Attackers noticed. Fraudulent codes inside email attachments have risen sharply because of exactly this gap.
How to scan without getting caught
Look before you tap. Modern phones show a preview of the destination after scanning and before opening it. Read it. Specifically read the part just before the first single slash, because that is the actual domain and everything after it can be faked to look reassuring.
An address like “yourbank.com.secure-login.net” is not your bank. It is secure-login.net, and the bank name is decoration. This one trick accounts for a large share of successful attacks.
Treat physical codes in public with more suspicion than digital ones. Stickers are trivially applied. If a code on a meter, table, or charger looks like it has been applied over something else, has a slightly different finish to the surface around it, or has a peeling edge, it probably has been. Feel the edge. It takes a second.
Never enter payment details on a page you reached by scanning a code in public. Not once. If a parking machine or a charger wants payment, use the machine’s own card reader or type the operator’s address into your browser yourself. This single rule would have prevented essentially every case I have read about.
Be sceptical of urgency. Fraudulent codes almost always arrive attached to a deadline: a fine to pay, a delivery that will be returned, an account that will be closed. That pressure exists to stop you thinking, and recognising it is more useful than any technical check.
And if a code opens something that wants an app installed, stop. Legitimate businesses do not distribute apps through codes on street furniture.
What businesses should be doing
If you use codes with customers, some of the responsibility sits with you.
Check your physical codes regularly. A restaurant with codes on forty tables should have somebody scan a sample of them weekly. Sticker attacks are only profitable while nobody notices, and noticing is easy if anybody bothers to look.
Design them so tampering is visible. A code printed as part of the table card, integrated with your branding, is much harder to overlay convincingly than a plain white sticker stuck on a surface. Laminated cards, engraved plates, and codes printed directly onto packaging are all harder to fake than adhesive labels.
Point codes at your own domain. This is the significant one. When customers scan and see your actual business name in the preview, they can verify it themselves. When they see an unfamiliar shortener domain, they cannot tell your code from a criminal’s, and you have trained them to accept unverifiable destinations. If you generate your own QR codes pointing at pages on your own website, that verification step works in your favour every time.
Tell customers what to expect. “This code opens menu.yourrestaurant.com” printed underneath costs nothing and makes a substituted code obvious.
And do not ask for payment card details on a scanned page. Even if it is legitimately yours. You are normalising exactly the behaviour that gets your customers robbed elsewhere.
The reasonable level of worry
Worth keeping in perspective. The codes themselves are not malicious technology, and a code cannot install anything on your phone by itself. It carries text, usually a web address. Everything harmful happens after you arrive somewhere and choose to do something.
Which means the defence is not avoiding codes. It is the same defence as every other online risk: check where you have landed before you type anything valuable into it.
Scanning a menu at a restaurant you are sitting in is essentially risk-free. Scanning a sticker on a parking meter and typing your card number into whatever appears is not. The difference is not the technology, it is what you do in the four seconds after.
If you produce codes for your own business, use a clean QR code generator, keep the destination on a domain you own, and check your printed ones periodically. That covers most of what is actually within your control.
The rest is just reading the address bar before you tap.
FAQ
Can a QR code install a virus on my phone? No. A code contains text or a web address. Any risk comes from what you do after arriving at the destination, such as entering details or installing something you were prompted to install.
What is quishing? Phishing delivered through a QR code. Attackers place codes leading to fake login or payment pages, often as stickers over legitimate codes in public places.
How do I check a QR code before opening it? Read the preview your phone shows after scanning. Focus on the domain immediately before the first single slash, as that is the real destination.
Are codes in emails riskier than printed ones? They bypass many security filters, because scanners cannot read text inside an image. Treat an unexpected code in an email exactly as you would an unexpected link.
How can a business protect customers from fake codes? Point codes at your own domain, print them into materials rather than on plain stickers, check them regularly, and never request card details on a scanned page.
