QR Code Phishing (Quishing)

QR codes are everywhere — menus, parking meters, invoices, office doors, conference badges, delivery notices.

Attackers love this.

QR code phishing (also called “quishing”) is when attackers use a malicious QR code to trick someone into visiting a fake website, downloading malware, or entering credentials.

It’s phishing — delivered through a square of black‑and‑white pixels.

Think of it like someone swapping the sign on a door.
The door looks the same.
The frame looks the same.
But the room behind it is not what you expect.

Digitally, quishing often involves:

fake MFA reset pages
fake Microsoft 365 or Google login pages
malicious downloads
credential harvesting
session hijacking
token theft
redirecting to attacker‑controlled sites
bypassing email filters (images aren’t scanned like links)

Once the victim scans the code, attackers can:

steal passwords
intercept MFA codes
hijack sessions
deploy infostealers
compromise email and cloud accounts
launch BEC, VEC, or payment fraud
move laterally across the network

Quishing works because people trust QR codes — and because scanning them moves the attack from a protected corporate device to a less‑protected personal phone.

🔍 Real‑World Incident

In 2023, multiple U.S. cities reported attackers placing fake QR codes on parking meters.
Victims scanned the codes, entered their credit card information into a fake payment portal, and unknowingly sent their data directly to cybercriminals.

The QR codes looked legitimate.
The payment pages looked legitimate.
The theft was instant.

🎬 International Film Parallel

In the Chinese thriller The Vanished Murderer, characters are misled by clues that look legitimate but redirect them into traps. Quishing works the same way — the QR code looks harmless, but the destination is dangerous.

📺 K‑Drama Parallel

In Watcher, characters follow leads that appear official but are planted to manipulate their actions. QR code phishing mirrors this dynamic — the victim believes they’re following a trusted path, but the attacker controls the endpoint.

📚 Novel / Non‑Fiction Parallel

In Future Crimes, Marc Goodman explains how everyday technologies become attack surfaces when trust is assumed.
And in The Art of Invisibility, Kevin Mitnick highlights how attackers exploit the smallest user actions — like scanning a code — to compromise entire systems.

Both works reinforce the same truth: convenience creates opportunity for attackers.

Learn more at https://insurancedesignationlookup.com/cyber-orientation/

Vocabulary Reinforcement (from earlier posts)

Phishing‑as‑a‑Service (PhaaS)
Malware‑as‑a‑Service (MaaS)
Infostealer Malware
Token Theft
Session Hijacking
MFA Bypass Techniques
Account Takeover (ATO)
Pretexting
Social Engineering
EDR
SIEM

Relevant Designations

AINS, CPCU, ARM, AU, Cyber‑specific designations (e.g., CCIC, CCBP), Fraud‑focused certifications (CFE)

Previous Episode:
38. Vishing ←

Next Episode:
40. Incident Response Basics →

Browse the Series:
View all Cyber in Plain English episodes →

Cyber Orientation Hub:
Explore the full Cyber Orientation hub →

Learn more at https://insurancedesignationlookup.com/cyber-orientation/
#CyberForInsurance #CyberInPlainEnglish #LettersForSuccess