Definition
Qshing, short for QR code phishing, is a cyber scam that uses fraudulent QR codes to steal personal information or trick victims into installing malware. When you scan a manipulated QR code with your smartphone camera, it redirects you to a spoofed payment site. If you enter your details or follow prompts to install a file, attackers can take control of your device remotely.
The Trap Hidden Behind Identical Pixels
You have likely scanned a QR code to pay at a cafe table or unlock a shared e-scooter on the street. QR codes look like a maze of black-and-white squares. To the human eye, it is impossible to tell which web address is hidden behind the pattern.
Scammers exploit this exact blind spot. They trick victims by slapping fake QR code stickers directly over legitimate codes in public spaces. Common targets include parking payment kiosks, shared bikes, and restaurant table menus—everyday spots where people point their smartphone cameras without a second thought.
When you scan the code as usual, your browser opens a fake webpage disguised as the real checkout screen. If you type in your card details or personal info, that data goes straight to the scammer in real time.
A Closer Look: How Malware Gets Installed
Qshing does not stop at fake payment forms. In more dangerous attacks, the destination website pushes you to download and install a malicious installation package (APK file). Because APKs are installer files for Android, attackers targeting iPhones usually stick to credential-stealing spoofed websites instead.
After mimicking a bank or government agency, the site displays an urgent prompt such as 'Security update required for verification.' If you tap confirm, spyware or Trojan malware silently installs on your phone.
Once inside, the rogue app tricks you into granting powerful system permissions, like reading SMS messages or screen accessibility. It can then intercept two-factor authentication codes and one-time passwords (OTPs) needed for banking transfers. In some cases, it even tracks your location and call logs. A single careless tap to install or grant permissions leaves your smartphone wide open.
Practical Steps to Avoid Qshing
Protecting yourself from Qshing comes down to a few basic habits before and after you scan. First, examine the physical QR code closely. If you see signs of a sticker placed over the original signage, or edges peeling up, do not scan it.
Second, always check the previewed URL that pops up on your camera screen before tapping it. If the domain looks strange, uses unfamiliar extensions, or has slight typos compared to the real official website, stay away.
Finally, close your browser immediately if a QR code link urges you to download or install any file. On Android devices, keep 'Install unknown apps' disabled in your security settings, and never turn it off just because a website asks you to. These simple precautions keep your phone and data safe.
Common misconceptions
Just scanning a fake QR code instantly drains your bank account.
Scanning alone cannot withdraw your funds. Financial loss only happens when you type in passwords on the fake website or install a malicious app that hijacks your device.
Where you meet it
A fake QR code sticker that a scammer placed over the real payment code on a shared e-scooter.
A QR code printed on a fake traffic ticket mailer that redirects to a spoofed government payment portal.
In one sentence
Qshing is a scam where attackers use manipulated QR codes to lure victims to phishing websites or trick them into installing malware to steal sensitive information.