Quishing: The New QR Code Scam

Watch Out for “Quishing”: The New QR Code Scam Threatening Your Financial Security

As QR codes become an increasingly common part of everyday transactions—from paying for parking to accessing online accounts—a new cybersecurity threat has emerged that all clients should be aware of: quishing.

Recently, Action Fraud, the UK’s national reporting centre for fraud and cybercrime, issued a fresh warning about this growing scam. Quishing, a type of phishing attack, involves fraudulent QR codes that are designed to steal personal and financial information when scanned.

According to Claire Webb, Acting Director of Action Fraud:

“QR codes are becoming increasingly common in everyday life… However, reporting shows cyber criminals are increasingly using quishing as a way to trick the public out of their personal and financial information.”

How Quishing Works

Quishing can occur in a variety of everyday settings:

• Car parks, where scammers place counterfeit QR code stickers over legitimate payment terminals.
• Online marketplaces, where fraudsters email sellers fake QR codes under the guise of account verification or payment processing.
• Phishing emails and text messages, which include rogue QR codes impersonating government bodies such as HMRC, with the goal of stealing sensitive data.

Tips to Protect Yourself and Your Finances

As financial advisers, we strongly encourage our clients and readers to stay vigilant. Here are some key steps to protect yourself:

• Be cautious when scanning QR codes in public spaces, especially in car parks or transport hubs. Always check that a code hasn’t been tampered with or overlaid with a sticker.
• Avoid scanning QR codes sent via unsolicited emails or text messages, especially if the source is unfamiliar or the request seems urgent or unusual.
• When in doubt, contact the organisation directly using a verified phone number or by visiting their official website.
• Stick to your phone’s built-in QR scanner, rather than third-party apps, which may be more vulnerable to security issues.
• QR codes in trusted venues, such as restaurants or pubs, are typically safe—but still, stay alert.

What to Do If You Suspect a Scam

If you receive a suspicious email containing a QR code, forward it to:
report@phishing.gov.uk

To learn more about protecting yourself from fraud, visit:
https://stopthinkfraud.campaign.gov.uk

If you believe you’ve been a victim of fraud, contact:
Action Fraud at 0300 123 2040 or report online at www.actionfraud.police.uk
(Scotland residents should call Police Scotland on 101)