Quishing: phishing por código QR: cómo funciona, señales y qué hacer
Social engineering · médio
By email, the scammer sends a QR code inside an image or PDF with a pretext such as renewing authentication, viewing a payslip or signing a contract. Because the link is not text, security filters may miss it, and scanning on a phone leads to a fake corporate login page.
In the physical world, fake QR stickers are placed over real ones on parking meters, charging stations, menus and posters, leading to fake payment pages. QR codes also arrive by mail or on flyers.
APWG's annual review highlighted growth in scams via social media, SMS, email and QR codes.
Sinais / Signs
- A QR code in an email asking for login, MFA or urgent signature
- A sticker placed over another QR code or with peeling edges
- The address shown by the scanner does not match the expected brand
- A page asking for card details for parking outside the official app
- A prompt to download an app from the QR code
Prevenção / Prevention
- Before opening, check the address the scanner displays
- Pay for parking and services through the official app from the store
- Companies: treat QR codes in email as suspicious links and train staff
- Do not log in to work accounts from a QR code received by email
- Prefer typing the service address
O que fazer / What to do
- If you entered a password, change it and sign out other sessions
- If you paid by card, alert the bank and dispute the charge
- Tell your IT team or the business about the fake QR code
- Report to the FTC (US) or CERT.br (Brazil)
FAQ
Can simply scanning a QR code infect my phone?
Scanning itself rarely causes harm; the risk is in opening the site, entering data or installing what it offers.
Can a Pix QR code be fake too?
Yes. Before confirming, check the recipient's name and ID in your banking app.
Radar
- — Trezor: brecha en socio de envíos alimenta ataques de phishing. Datos filtrados de un socio logístico del fabricante de billeteras cripto se usan para phishing contra clientes. Fuente: Help Net Security
- — Xsolis: phishing provoca brecha con datos de 1,4 millones de personas. La empresa de tecnología sanitaria atribuyó la brecha a un ataque de phishing. Fuente: Help Net Security
- — APWG: el phishing bate récord de 1,13 millones de ataques en el 2T 2025 · 1,13 mi (2T25). El volumen bajó a 853.000 en el 4T; redes sociales y SaaS/webmail fueron los más atacados (20,3% cada uno). Fuente: APWG Phishing Activity Trends Q4 2025
- — Kaspersky bloquea 553 millones de ataques de phishing en Brasil en 12 meses · 553 mi bloqueios. Son 1,5 millones al día y el 42,8% del total de América Latina, donde los bloqueos crecieron 85%. Fuente: Kaspersky, Panorama de Ameaças 2025 (via InfoMoney)