QR Code Security & Phishing

As QR codes spread throughout daily life, cybercriminals are increasingly exploiting them. A new type of crime called 'Quishing' — a combination of 'QR' and 'Phishing' — has become a growing threat. Common tactics include sneaking fake QR code stickers over legitimate ones in parking lots, bike-sharing stations, and restaurant tables to redirect victims to malicious websites. In this guide, we'll cover the reality of quishing, how to protect yourself, and principles for generating safe QR codes.

What Is Quishing and Real-World Cases

Quishing involves placing a malicious QR code sticker over a legitimate one, or embedding QR codes in phishing emails that lead to harmful URLs. Cases surged starting in 2024, including fake parking tickets with QR codes disguised as fine payment pages, and swapped QR codes on shared scooters used to steal payment information. Internationally, similar tactics have been reported on parking meters and restaurant menus. These attacks exploit people's habit of scanning QR codes without suspicion, which is why awareness is the most important defense.

Personal QR Code Safety Tips

Always use URL preview when scanning a QR code. Most smartphone camera apps show the destination URL before you open it. If the domain looks suspicious or uses a URL shortener (bit.ly, etc.), don't proceed. Physically check public QR codes for signs of sticker tampering. If a QR code asks you to enter personal information or make a financial transaction, visit the official app or website directly instead. Never scan QR codes from unknown emails or text messages.

Business QR Code Security Strategy

Businesses using QR codes for marketing or services need a solid security strategy. First, strengthen the physical security of QR code placement locations. Use tamper-proof materials to prevent sticker replacement, and establish regular inspection routines. Landing pages linked from QR codes must have SSL certificates and use your own domain to build trust. Informing customers about what your official QR codes look like and where they are located reduces the risk of falling for counterfeit QR codes.

Principles for Safe QR Code Generation

Security matters when creating QR codes too. Start by using a trusted QR code generator. Static generators like QRgen.kr encode the URL directly into the QR code without any intermediary server, eliminating the risk of URL tampering. Some free dynamic QR services, on the other hand, route through redirect servers that could be compromised. Use HTTPS for the URL you embed, and whenever possible, use the full original URL instead of a shortened one. Always scan-test your QR code after generating it to confirm it leads to the correct page.

QR codes are convenient tools, but careless use without security awareness can lead to quishing attacks. Individuals should check URLs before opening, and businesses should develop both physical and digital security strategies. Using a trusted tool like QRgen.kr to generate static QR codes ensures safe usage without relying on intermediary servers.