QR code phishing (quishing): كيف يعمل وعلامات التحذير وماذا تفعل
Social engineering · médio
By email, the scammer sends a QR code inside an image or PDF with a pretext such as renewing authentication, viewing a payslip or signing a contract. Because the link is not text, security filters may miss it, and scanning on a phone leads to a fake corporate login page.
In the physical world, fake QR stickers are placed over real ones on parking meters, charging stations, menus and posters, leading to fake payment pages. QR codes also arrive by mail or on flyers.
APWG's annual review highlighted growth in scams via social media, SMS, email and QR codes.
Sinais / Signs
- A QR code in an email asking for login, MFA or urgent signature
- A sticker placed over another QR code or with peeling edges
- The address shown by the scanner does not match the expected brand
- A page asking for card details for parking outside the official app
- A prompt to download an app from the QR code
Prevenção / Prevention
- Before opening, check the address the scanner displays
- Pay for parking and services through the official app from the store
- Companies: treat QR codes in email as suspicious links and train staff
- Do not log in to work accounts from a QR code received by email
- Prefer typing the service address
O que fazer / What to do
- If you entered a password, change it and sign out other sessions
- If you paid by card, alert the bank and dispute the charge
- Tell your IT team or the business about the fake QR code
- Report to the FTC (US) or CERT.br (Brazil)
FAQ
Can simply scanning a QR code infect my phone?
Scanning itself rarely causes harm; the risk is in opening the site, entering data or installing what it offers.
Can a Pix QR code be fake too?
Yes. Before confirming, check the recipient's name and ID in your banking app.
Radar
- — Trezor: shipping partner breach fuels phishing attacks. Data leaked from the crypto wallet maker's logistics partner is being used to phish customers. المصدر: Help Net Security
- — Xsolis phishing attack leads to breach of 1.4 million people's data. The healthcare technology firm attributed the breach to a phishing attack. المصدر: Help Net Security
- — APWG: phishing hits record 1.13 million attacks in Q2 2025 · 1,13 mi (2T25). Volume fell to 853,000 in Q4; social media and SaaS/webmail were the most targeted sectors (20.3% each). المصدر: APWG Phishing Activity Trends Q4 2025
- — Kaspersky blocks 553 million phishing attacks in Brazil in 12 months · 553 mi bloqueios. That's 1.5 million a day and 42.8% of Latin America's total, where blocks grew 85% to 1.29bn. المصدر: Kaspersky, Panorama de Ameaças 2025 (via InfoMoney)