Quishing: defense strategies against QR Code scams

The phenomenon of computer fraud has evolved with the arrival of QR Codes, an increasingly widespread medium both online and in everyday life. We talk about "quishing", a term derived from the fusion of the terms QR code and phishing, to designate a new form of online scam. By scanning these codes, users can stumble upon fraudulent sites, which trick them into sharing sensitive data or downloading malicious software. The extent of this threat was confirmed by the US Federal Trade Commission (FTC) which issued a warning statement. There is an increasing trend in fraudulent uses of these tools, as evidenced by the 60,000 cases of QR Code attacks detected by Trellix in the third quarter of a recent year alone.

Methodologies perpetrated by cybercriminals

In Italy, studies such as those by Harmony Email highlight an escalation of fraud linked to QR codes with an increase of 587% between August and September. In the United States, citizens who used QR codes via mobile devices reached 89 million in 2022, with a projection of over 100 million by 2025. Barracuda, a cybersecurity company, highlighted various ways in which scammers operate, ranging from classic phishing page to the download of malware and access to payment sites manipulated via QR Code, demonstrating the variety and agility of the attack methods.

FTC tips for user safety

To protect themselves from these risks, users will first need to exercise their critical judgment. The FTC recommends avoiding scanning QR Codes received in suspicious messages or unexpected emails with urgent requests. It is vital to check the URLs that open following the scan, ensuring their reliability, and prefer direct links to sites of interest, avoiding the use of unverified third-party applications.

Preventive practices in the daily use of QRs

Experts reiterate the importance of the conscious and critical use of QR Codes in everyday life, favoring the cameras integrated into Android and iOS devices that scan the codes directly. It is essential to be wary of QR Codes placed in unusual places or in contexts where alternative methods of access or payment exist, favoring safer and more traditional solutions.