Quishing: the new QR Code scam

For the past few years, the QR code (Quick Response code) has invaded our daily lives. Whether it's to scan a menu in a restaurant, access a web page, or even make a payment, these small matrices of black and white dots have become essential tools in the digital age. But behind this apparent simplicity lies a growing danger: quishing, a new form of scam that exploits QR codes to deceive users.

What is a QR code?

A QR code is a two-dimensional barcode designed in the 1990s to store large amounts of information. Unlike traditional barcodes, which can only contain a series of numbers, a QR code can encode various types of data: URL, text, GPS coordinates, contact information, etc. You just need to scan it with your smartphone camera to instantly access the content it contains.

Why use a QR code?

The main advantage of the QR code is its speed and convenience. No need to manually enter a URL or a complicated series of numbers: a simple scan is enough to access information or perform an action. This tool is particularly appreciated in the marketing and communication sectors because it allows businesses to create direct links to web pages, promotions, videos, or social networks.

With the Covid-19 pandemic, the use of QR codes has exploded, especially in restaurants and for contactless payments. In just a few seconds, a consumer can access a menu, pay a bill, or even download an application.

The risks and drawbacks of QR codes

Despite all its advantages, the QR code also has drawbacks, especially in terms of security. The user doesn't always know what information is hidden behind the code before scanning it. This opens the door for cybercriminals who exploit this vulnerability to deploy scams.

Quishing (a contraction of "QR code" and "phishing") is one of these scams. This term refers to a fraud technique where a QR code is used to redirect a person to a malicious site. The goal? To steal personal information, such as login credentials, or to trick the victim into making a fraudulent payment.

How does quishing work?

The mechanism of quishing is simple but effective. A scammer creates a fake QR code that, once scanned, redirects to a fraudulent site. This site can perfectly mimic a legitimate one (such as a banking service or an online shopping platform) to encourage the user to enter sensitive information.

Malicious QR codes can be placed in public places (bus stops, vending machines, billboards), sent via email or text message, or embedded in websites. The user, often in a hurry or unaware, scans the code without checking the source, opening the door to cybercriminals.

How to protect yourself from quishing?

There are several precautions to take to avoid falling into the quishing trap:

• Check the source: Only scan a QR code if you are sure of its origin. If you find a code in a public place or on an unsecured site, it's better to avoid it.
• Use secure scanning apps: Some scanning apps allow you to check the URL before redirecting the user. This allows you to verify the address where you will be directed.
• Beware of QR codes in unsolicited emails or SMS: Scammers can send malicious codes through digital channels. It is advisable not to scan these codes unless you are absolutely certain of the sender.
• Watch for suspicious behavior: If after scanning a QR code, you are redirected to a site asking for sensitive information (credit card number, password, etc.), immediately close the page.

Conclusion

The QR code is an extremely useful and convenient tool, but like any digital tool, it presents risks if misused. Quishing perfectly illustrates how cybercriminals know how to exploit vulnerabilities to trap unsuspecting users. The best defense against these attacks is vigilance. Before scanning a QR code, always ensure its legitimacy. A simple precaution can save you a lot of trouble.