Delivery technique · MITRE ATT&CK T1566.002

QR code phishing (quishing)

Phishing links hidden in QR codes on emails, letters, parking meters, or posters, which bypass link scanners and move the victim to a phone.

How it works

1. A QR code replaces a visible link.
2. Scanning opens a fake payment or login page on a personal phone.
3. Mobile browsers hide the full address, so the fake is harder to spot.

Defenses

• Treat QR codes in unsolicited messages as untrusted links.
• Pay parking and tolls through the official app.
• Extend email security to images and attachments that carry QR codes.

Reference: FBI IC3 PSA on toll smishing