What is ‘quishing'? The new QR code scam that is on the rise

QR codes are everywhere, offering quick access to information and services. However, with convenience comes risks, especially as scammers use these codes to orchestrate scams and steal personal information.

"You can put essentially any web page you want behind a QR code, whether that's a restaurant menu, a doctor check-in or anything you want behind that kind of funky-looking image," said Jeremy Fuchs, a security research analyst.

As usage soars, 94 million people in the U.S. are expected to use QR scanners this year and projected to rise to over 100 million by 2026. 

The Federal Trade Commission (FTC) alerts the public to a tactic known as "quishing," where scammers embed malicious links in QR codes. These codes often lead unsuspecting users to fake websites that trick them into thinking there’s an urgent problem, like a package that wasn’t delivered or an issue with your account. 

Scammers aren't limiting themselves to one method: they're placing these malicious QR codes on physical items like parking meters and sending them via emails or texts.

“Email seems to be the dominant vector at the moment. That's not to say it doesn't happen in other mediums, but email is by far the easiest," Fuchs said.

He also anticipates that this threat will persist.

“This is going to continue until people and technology kind of meet the challenge, meaning that our vigilance has to remain high for a while as well," Fuchs said.

To safeguard against these threats:

• Always be cautious with QR codes, especially if found in unexpected places.
• Verify the URL before opening it, looking out for misspellings, or switched letters.
• Avoid scanning QR codes received through unsolicited emails or texts.
• Regularly update your phone's operating system.
• Use strong passwords and enable multi-factor authentication on your accounts.

The consequences of falling victim to a QR code scam can be severe, with the FTC warning that thieves can empty bank accounts, make fraudulent credit card charges, open new accounts in your name, and even file fraudulent tax returns. 

Victims are urged to report incidents at IdentityTheft.gov.