Quishing: how to spot fake QR codes and how businesses can prevent it

Quishing combines “QR” and “phishing”. It describes fraud where a QR code leads to a page that does not belong to who you think. Well known are covered-over codes on parking meters and charging stations: someone sticks their own code over the real one, and anyone who scans lands on a copied payment page.

The trick works because you cannot see the address in a QR code. That is exactly where the countermeasures start, for readers and for businesses.

How to recognise a genuine address

After a scan, the camera app shows the address before it opens anything. Read it instead of tapping straight away. What matters is the part between “https://” and the first slash, which is the domain.

• qr.yourcompany.com/menu belongs to yourcompany.com. That is the business’s domain.
• yourcompany.com.parkpay-now.com, on the other hand, belongs to parkpay-now.com, even though the company name comes first. The end of the domain is what counts.
• Watch for typos, swapped letters and extra hyphens in the name.
• Short links from unknown services hide the destination. On a parking meter or an invoice, that is a reason to look closer.
• If the page asks for payment details, passwords or a download right after the scan, caution is right.

Check on the spot before you scan

• Run a finger over the sticker. If you feel an edge or can lift a corner, a second code may be underneath.
• If the code looks different from the rest of the signage, such as different paper, different print or a crooked fit, be suspicious.
• If there is an address in plain text next to the code, compare it with what the camera app shows.
• When in doubt, type the address yourself or ask staff. You can often pay another way at the machine.

What businesses can do

Covering a code cannot be prevented completely, because anyone can put up a sticker. But you can make a lot of it easier to verify.

• Print the address in plain text under the code, easy to read and short enough to type. Anyone who compares it notices a difference immediately.
• Use your own subdomain such as qr.yourcompany.com instead of someone else’s domain. Guests learn that genuine codes from your business always start with your name.
• Check your codes regularly, for example on every walk-round, and put it in a fixed schedule.
• Place codes so that covering them is noticeable: printed directly on the material, under a protective film or in a frame, rather than as a loose sticker.
• Tell your guests. A line like “Genuine codes from us start with qr.yourcompany.com” on the menu or table helps more than you might think.
• Keep an eye on scan numbers. If a code that is usually scanned often suddenly drops to almost zero, take a look on site.

What your own domain does and does not do

Your own domain does not stop someone from sticking another code over yours. It does help with recognition: your guests see your name in the address, and a fake code stands out more. The domain is also yours, so you can take it to another provider at any time, and printed codes stay valid.

With Same-QR you choose the path yourself when creating a new code, for example qr.yourcompany.com/menu. It is short, memorable and easy to print under the code. Your own domain is available from Gastro Pro or Marketing Starter, and existing codes keep their address.

Frequently asked questions