What is QR-Phishing?

QR phishing (also known as quishing) is when attackers create fake QR codes that lead you somewhere you weren’t expecting. Often, the destination is a malicious website designed to steal your information, download malware, or trick you into taking unsafe actions.

Which of the following best describes what QR-Phishing is?

QR phishing is when attackers use fake QR codes to send you to malicious sites, download and install malware, or steal your information.

View Options Again

How to protect yourself from QR-phishing scams

QR codes are everywhere, but that doesn’t mean they’re all safe. That’s why it’s important to check the context, preview the link, type the URL manually if something feels off, and never share sensitive information without a clear reason. Let’s explore these key safety tips in more detail.

Context Matters

Always check the context before scanning a QR code, especially in public places. If it’s randomly placed with no explanation, it could be planted by an attacker. Scanning a QR code without verifying its source or purpose leaves you vulnerable to potential scams.

Check The Link

Before clicking a QR code link, check the URL preview that appears on your screen. Look for spelling errors, odd characters, or anything that feels off. If the link doesn’t match what you expected, don’t tap it.

Why is it risky to scan a QR code placed on a lamp post or public bench?

Public QR codes can be planted by attackers to entice you into interacting with malicious content. If the code looks random or has no clear reason for being there, it could be a scam.

View Options Again

Manually Enter The URL

If a QR code seems suspicious, don’t trust it. Where possible, instead of scanning, type the website address directly into your browser. That way, you know exactly where you’re going and are less likely to be tricked by a fake or misleading link.

When scanning a QR code, what should you do before clicking the link?

Always check the link carefully. Fake URLs are designed to look real at first glance, but small differences can lead you to malicious sites and put your information at risk.

View Options Again

Protect Your Personal Information

If a QR code immediately asks for personal or financial details, that’s a red flag. Legitimate organizations won’t request sensitive information without proper context, verification, or a secure environment. Always pause and question why the information is being requested before handing it over.

Is the following statement True or False:
It is normal for a QR code to immediately ask for personal or financial information after scanning

Legitimate organizations don’t ask for personal information right after a scan. If a QR code demands sensitive details without context, it’s likely a phishing scam. Always verify before trusting it.

View Options Again

Why is manually typing in a URL safer than scanning a QR code?

When you type a URL, you know exactly where you're going. With a QR code, you're trusting whoever made it. Attackers can use them to hide fake or dangerous links that look safe but are not.

View Options Again

What QR Codes Are Capable Of

QR codes are powerful shortcuts. They save time, simplify access, and make interactions almost effortless. That convenience can be hijacked. Here are just a few ways attackers can weaponize them.
One quick scan can take you to a spoofed site that steals your credentials, or trigger a hidden download that installs malware on your device. These attacks often happen silently, leaving you unaware that anything went wrong until it's too late.
Cybercriminals often use digital or physically printed QR codes to embed a smart link, which, when scanned and clicked, automatically detects the victim's operating system and then loads their device's native app store, with a malicious app ready for installation.
QR codes can silently insert events into your calendar or connect your device to an unsecured WiFi network. That “meeting invite” might contain phishing links, and that "free hotspot" could be a setup to intercept your data and monitor activity without your knowledge.

Which of the following could a malicious QR code do?

Cybercriminals use QR codes to embed fake Wi-Fi network configurations, which mobile devices then use to automatically connect to a rogue Wi-Fi network, which in this case is controlled by the attacker, with all data being intercepted.

View Options Again

Which of these is NOT a safe QR code practice?

Scanning QR codes in public bathrooms is unsafe because anyone, including cybercriminals, could have placed those codes there.

View Options Again

A restaurant QR code stand asks for your credit card information immediately. What should you do?

If a QR code leads to a page asking for credit card information, especially somewhere like a restaurant, it’s a red flag. Legitimate menu links shouldn’t ask for payment up front.

View Options Again

Risks Beyond Public Spaces

QR codes aren’t just showing up on posters and stickers anymore. Scammers are slipping them into phishing emails, SMS messages, social media posts, and even fake bills sent by post. These codes are used to bypass traditional security filters and catch you off guard in more trusted, private settings.

Which of the following is a non-public way scammers might deliver malicious QR codes?

Scammers can deliver malicious QR codes through SMS messages, email attachments, and fake invoices sent by post. These methods target you in more trusted environments, increasing the chances you'll scan without thinking.

View Options Again

Importance of understanding QR-phishing

QR-phishing is a growing threat that preys on convenience and habit. With QR codes popping up on menus, posters, and invoices, people often scan without a second thought. Slowing down before scanning helps keep cybercriminals out.

The Importance of QR Scam Awareness

Stay vigilant. Always check the context of a QR code before scanning. Preview the link before clicking or better yet, type it in yourself. A few smart habits can stop QR phishing and help keep you one step ahead of scammers.