First there was phishing. Then came smishing. Now, we’re being warned about quishing, an attack in which a QR code is used to manipulate users, typically by redirecting them to a website that either downloads malware or solicits their sensitive information.

A QR code, or quick response code, is a square barcode that compatible mobile device cameras can read. When a user scans a QR code, it often opens a web page, although it could also trigger a phone call, text message, or digital payment.

Anecdotal evidence suggests quishing attacks have increased since the beginning of the COVID-19 pandemic when a growing number of legitimate organizations started using QR codes to enable low-contact transactions. Many restaurants, for example, link QR codes to online menus, rather than providing hard copies. Digital wallets use QR codes to facilitate contactless payments. As users have become increasingly accustomed to interacting with QR codes in daily life, quishing opportunities have increased.

According to the Better Business Bureau, a common scam involves sticking fraudulent QR codes on parking meters to trick drivers into sharing financial credentials when they try to pay for parking. Consumers also can encounter QR code scams in emails, in text messages, on signage, on direct mail, and even in person from criminals posing as utility workers or government employees.

The best defense against quishing attacks is an educated user base. Here are some best practices you can use to avoid falling victim to an attack:

• Never scan a QR code from an unfamiliar source.
• If you receive a QR code from a trusted source via email, confirm through a separate medium – text message, voice call, etc. – that the message is legitimate.
• Stay alert for hallmarks of phishing campaigns, such as a sense of urgency and appeals to emotions such as sympathy, fear, etc.
• Review the preview of the QR code’s URL before opening it to see if it appears legitimate. Make sure the website uses https rather than http, doesn't have obvious misspellings, and has a trusted domain. Don’t click on unfamiliar or shortened links.
• Be extremely wary if a QR code takes you to a site that asks for personal information, login credentials, or payment.
• Observe good password hygiene by changing your email password frequently and never using the same password for more than one account.

The simplest thing you can do is not scan QR codes – especially those from unknown sources.

Ray Wills is security officer for F&M Trust.