Quishing
A phishing link hidden inside a QR code, so you cannot see where it leads.
Quishing hides a phishing link inside a QR code. Because a printed or on-screen square gives no clue where it leads, scammers use it to smuggle you towards a fraudulent page you would never have tapped as a plain link. The codes turn up stuck over genuine ones on parking meters and restaurant tables, printed on fake parcel cards, or embedded in emails to slip past filters that scan for suspicious web addresses.
Once scanned, the destination behaves like any other phishing site — a spoofed login or payment form built to capture what you enter. Two habits blunt it: before acting, check the preview address your phone shows after a scan and confirm it matches the organisation you expect, and be wary of any code that then asks you to log in or pay. Treat a sticker placed over another code as a warning in itself. Our article on QR-code scams covers where they appear and how to scan safely; the underlying trick is ordinary phishing in a new wrapper.