Organised gangs behind rise in QR 'quishing' scams
1–10 of 49 posts
Re: Organised gangs behind rise in QR 'quishing' scams
#2Why not a short URL where one can at least read the domain name and see if it looks reasonable before progressing with whatever the task ($£kr) is
Re: Organised gangs behind rise in QR 'quishing' scams
#3How do you protect yourself from this? Treat public QR codes like "free" USB drives – don't use them?
Re: Organised gangs behind rise in QR 'quishing' scams
#4Hey, guys, I have this crazy idea.
How about we have people give small bits of paper to other people to pay for things? Or maybe even wave small cards of plastic in front of things that can read them? Maybe how about not using my fucking phone for every goddamn thing?
Crazy, right? KTHXBYE.
Re: Organised gangs behind rise in QR 'quishing' scams
#5Why not a short URL where one can at least read the domain name and see if it looks reasonable before progressing with whatever the task ($£kr) is
Even seeing the domain name doesn't solve the fundamental trust problem. A malicious actor could post a fake QR code or fake short URL leading to "city-parking-secure.com" or similar legitimate-looking domain.
The real solution is establishing a trusted channel - citizens need to know they should only pay for municipal parking through their city's official domain (e.g., sf.gov/parking). But this isn't possible when it's some random parking company. I don't see a great solution.
Re: Organised gangs behind rise in QR 'quishing' scams
#6Hey, guys, I have this crazy idea. How about we have people give small bits of paper to other people to pay for things? Or maybe even wave small cards of plastic in front of things that can read them? Maybe how about not using my fucking phone for every goddamn thing ? Crazy, right? KTHXBYE.
These are all too insecure in 2025. Everyone knows that phones are impenetrable fortresses which only one person can ever access, and nobody has ever been mugged into transferring money to someone else using their phone.
Re: Organised gangs behind rise in QR 'quishing' scams
#7The parking garage one can be really insidious. The parking apps where I live in Canada have a terrible design; you absolute cannot start parking session without an account that requires you to input name, address, phone number, and then the app itself has other technical glitches that genuinely made me wonder if I had been scammed.
What makes it doubly so is that the parking companies have been removing the parking machine terminals in some locations. The Royal BC Museum in Victoria BC comes to mind last time I was there. I'd be surprised if someone hasn't at least tried a QR code scam on it by now.
Re: Organised gangs behind rise in QR 'quishing' scams
#8How do you protect yourself from this? Treat public QR codes like "free" USB drives – don't use them?
The same way you might treat a URL randomly written on a billboard.
Barring vulnerabilities in your QR reader, it should be enough to just read the URL.
Re: Organised gangs behind rise in QR 'quishing' scams
#9The parking garage one can be really insidious. The parking apps where I live in Canada have a terrible design; you absolute cannot start parking session without an account that requires you to input name, address, phone number, and then the app itself has other technical glitches that genuinely made me wonder if I had been scammed. What makes it doubly so is that the parking companies have been removing the parking…
That's just all parking apps in my experience.
The websites (if they exist) are usually about as bad.
Car parks make more money if they can fine you, so there's no incentive to make payment easy or make it work reliably.
Re: Organised gangs behind rise in QR 'quishing' scams
#10Having lived in China for five years and seeing how it is done there (literally everywhere), I see this as a payment problem. There is no sensible, low cost payment infrastructure to support this safely. Instead most of the west has a fractured app ecosystem where each app ‘does payment’ rather than via a set of trusted payment apps that do the security up front and then passes to the provider.
For example, in the article the photos show an anonymous QR code you’d scan with your camera, rather than in China where you’d use Alipay or WeChat, whose app you’d use to scan the QR.
When I returned from China, it took a while to readjust to the heightened (and often expensive) friction of payments.
Not saying scams don’t exist in China, just that the payment provider gives some guarantees on the veracity of the claim made by the QR code