If you’ve recently looked at a gift card, tickets, or advertisement, you’ve seen a QR code. QR stands for Quick Response and it can be scanned with your phone to have instant access to a website or payment application. Using a QR code is quick and convenient. Unfortunately, imposter codes are indistinguishable from legitimate ones and if you scan one, you could download malware, share your personal data, or send messages without knowing.
Quishing, short for QR code phishing, is an identity fraud scam utilizing QR codes. Attackers take advantage of this by placing their own QR codes instead of legitimate ones in popular places, such as restaurants, hotels, or parking meters. Other times, they may advertise fake prize giveaways with QR codes on them. They may have websites to insert their own dangerous QR codes or create websites that look like the real thing and load them with QR codes. They may send a social media message with a QR code, counting on your curiosity and instinct to find out what it is right away. You scan it and that's when the trouble begins. Once you scan the QR code, it takes you to a scammer’s website, which may look legitimate, where the scammer lures you into providing personal or financial information.
Here’s how you can avoid quishing:
Inspect - Check if a sticker is placed over an original sign.
Preview the URL - Use your phone’s built-in camera rather than a random third-party scanner and look at the web address pop up before tapping it.
Watch for typos - Check the domain name carefully for misspelled words or swapped letters.
Avoid unexpected codes - Be cautious about QR codes sent inside emails or text messages.
Use manual entry for payments -If you are paying a bill, skip the QR code and download the official app or type the web address directly into your browser.
Thank you for reading about Quishing. We hope you’ll use the tips to stay safe. Now, here’s your chance to win a $300 Amazon gift card! Just answer the following correctly and you’ll be entered to win!
Contest Rules: No purchase necessary. Void where prohibited. One entry per person. Must be 18 years of age or older to enter. Employees and family members of PenTeleData and their affiliates are ineligible. This contest is open to legal residents in PenTeleData territories only. One winner will be randomly selected from correct entries and will be announced after the selection on or about November 30, 2026. In the event that the selected winner cannot be contacted or fails to respond within 24 hours of our initial notification, the prize will be awarded to an alternate winner selected from the remaining eligible entries. Odds of winning will depend on number of correct entries. Winners must grant permission for PenTeleData to use his/her name, statements and image in future promotions, without compensation. All PenTeleData decisions and prize awards are final. Prizes will not be substituted and are not refundable, transferable, or redeemable for cash. Winner is responsible for all taxes on prize.