QR phishing (quishing)

QR phishing (quishing) hides a harmful link inside a QR code, so one scan can open a fake payment page or start a download.

QR phishing (quishing): QR phishing, also called quishing, puts a malicious link inside a QR code. You cannot read a QR code by eye, so a scan can open a fake login, a payment request or an app download without you seeing the web address first. Stickers and posters are easy to swap.

In India, UPI QR codes are trusted by habit. Scammers tell sellers to scan a code to receive money, which actually sends money out. Fake stickers are placed over real QR codes at shops, parking areas and charging points. Some emails and posters carry QR codes so that spam filters cannot see the link. Printed codes in lifts, parks and on parcels have also been used to lure people to fake pages.

Remember that scanning a code is only for paying, never for receiving. Look at the name and amount on the payment screen before you enter any PIN. If a printed code looks stuck on top of another one, ask the owner. Check where a code leads before you continue. Treat every code as a link you have not read yet, and slow down before you scan.

Tips

• Never scan a QR code to receive money; you never need a PIN to receive.
• Check the name and amount shown before entering your UPI PIN.
• Use Safeavio's QR check to see where a code leads before you pay or open it.

Related terms