What is Quishing?
QR code phishing, known as quishing, has become one of the fastest-growing cyberscams in North America. Here's what it is, why it works, and how to protect yourself.
The short version
A scammer prints a fake QR code, or pastes one over a real one, and you scan it thinking it leads somewhere legitimate. Instead, it takes you to a fraudulent website designed to steal your credentials, payment information, or install malware.
Unlike a suspicious-looking link in an email, a QR code gives you no preview of where you're going. Your phone's camera just takes you there.
Why QR codes are uniquely risky
- You can't hover over a QR code to see the URL before visiting it.
- Anyone with a printer can replace a legitimate QR code with a malicious one.
- Shortened or encoded URLs inside QR codes hide the final destination.
- The physical location of a QR code (a restaurant, a parking meter, a poster) creates false trust.
Where quishing attacks happen
Quishing targets places where you'd naturally scan a QR code without thinking twice:
- Parking meters and pay stations: Fake codes redirecting to cloned payment pages.
- Restaurant menus: Physical stickers placed over the real code.
- Package deliveries: Phishing texts or cards with QR codes claiming to track a parcel.
- Public posters and flyers: Events, promotions, or "free Wi-Fi" codes.
- Email and phishing campaigns: QR codes embedded in emails to bypass spam filters.
How to protect yourself
Check the URL before tapping
After scanning, your phone shows you the URL. Look at it before opening.
Look for tampering
If a QR code looks like a sticker placed on top of something, be suspicious.
Use a safety app
Apps like QRbolt check the destination before you visit it.
Trust your instincts
If the landing page asks for payment or credentials immediately, leave.
How QRbolt helps
When you scan a QR code with QRbolt, the app checks the destination URL against threat intelligence databases before opening it. If the code is linked to a known scam, a phishing domain, or a recently reported threat, you'll see a warning before going anywhere.
Every scan you make also contributes anonymously to the Shelf Index, Canada's public record of QR code safety. The more Canadians who scan, the more comprehensive the database becomes for everyone.