A QR code does not say who made it
The square of pixels carries no seal of origin. To the naked eye, a legitimate code and an imitation are identical: you can only tell them apart by opening the link, when it is often too late.
🛡️ QR security
What is quishing? Phishing that travels inside a QR code
“Quishing” is a blend of QR and phishing: a scam in which the malicious link does not arrive as a clickable text, but hidden inside a QR code. The victim scans it trusting the context (a poster, a parking meter, an invoice) and lands on a website that imitates the familiar one. Here we explain how it works, what the institutions have said, and what you can do if you are the one issuing the codes.
● Institutional sources: INCIBE and FBI/IC3● No overpromising
How it works
Why a QR code is a good hiding place for a bad link
The attack is not technically sophisticated. It exploits three things a QR code has “out of the box”.
It sidesteps the security perimeter
The QR code moves the click from the filtered corporate inbox to a personal phone, without the same protections. For many filters, an image is not a link to analyse.
Context does the convincing
A sticker on a parking meter, a poster on a wall or an invoice with the right logo provides the trust the attacker needs. Victims do not doubt the code because they trust the surroundings.
What the institutions say
This is not vendor alarmism: official bodies document it
For public materials we use institutional sources only. Figures from security vendors are left as context, never as a claim.
INCIBE (Spain)
Spain's National Cybersecurity Institute has warned about QR code fraud and documented its most common vector: fake stickers placed over legitimate QR codes on parking meters, café terraces and EV chargers, impersonating city council websites and payment gateways.
FBI / IC3 (US)
The FBI's Internet Crime Complaint Center (IC3) has issued official warnings about QR code scams, such as unsolicited packages with a QR code in the box. Quishing even appears in operations attributed to state actors.
GS1 (standards)
The body behind barcode and QR standards is clear: a code's trust does not come from the square of pixels, but from the brand domain behind it. That is exactly the piece quishing tries to fake.
Honesty
What a signed QR code prevents, and what it does not
No technology “stops quishing” entirely, and anyone who promises that is selling smoke. It is worth stating exactly what you do get.
The signature does not prevent the attack
A scammer can always print their own QR code pointing to their own domain. Nothing you do with your codes stops them from creating new ones.
The signature prevents impersonation of you
What you do get: anyone can check that a code was issued by your brand. An imitation without your signature gives itself away when verified.
Consumers hardly ever verify
The research is consistent: most users check nothing before scanning. That is why the value is not that millions of citizens verify, but that it can be verified: it gives you an answer when an incident happens and protects your reputation.
It is a layer of brand trust, not a cybersecurity tool that detects threats like an antivirus or an email filter. The exact promise is issuer authenticity (this code was issued by this organisation) and destination integrity (the link lives on the organisation's domain and will not expire into third-party hands).
If you are the one issuing QR codes
Three layers to prove a code is yours
1
Your own domain
Have all your QR codes point to your domain, not to a generic shortener. Users see qr.yourbrand.com, not some bit.ly link. This is the good practice GS1 recommends.
2
Issuer signature
Each code carries a cryptographic signature that only your key can generate. The private key never leaves your browser; the public key is published so anyone can check it.
3
Public verifier
A web verifier open to all: paste a URL or point the camera at the code, and the check happens on the device itself, with nothing to install and no account to create.
Frequently asked questions
Common questions about quishing
What does quishing mean?
It is a blend of QR and phishing: a scam in which the malicious link arrives hidden inside a QR code instead of as a text link. The victim scans the code and ends up on a fake website that asks for personal data or a payment.
Why does quishing get past email filters?
A QR code is an image, not a readable link. Many email filters do not analyse where it points, and the scan usually happens on a personal phone, outside the company security perimeter.
Does a signed QR code stop quishing?
Not entirely, and it would be dishonest to promise so: an attacker can always print their own QR code pointing to their own domain. What the signature does is stop the attack from passing itself off as you: anyone can check that a code was issued by your brand and not by an imitator.
What have INCIBE and the FBI said about quishing?
INCIBE, Spain's National Cybersecurity Institute, has documented QR code fraud in Spain, above all fake stickers placed over legitimate QR codes on parking meters, café terraces and EV chargers. The FBI, through its IC3 complaint centre, has published official warnings about scams that use QR codes.
Keep reading
QR security cluster
Go deeper into each piece of the problem and of the response.
Your QR codes, signed and on your own domain
You cannot stop someone from printing their own QR code. You can give everyone a way to check that yours are yours. That is the trust layer Qmarque adds to every code.