Quishing: What To Do When "Check The URL First" Doesn't Work

Someone put a sticker over the QR code on a parking meter in Ottawa. The page it led to used the same fonts and the same colours as the real one. You typed in your card, the page stalled, and in the background a stranger was adding that card to their own mobile wallet. That is quishing: ordinary phishing, delivered as a printed square instead of a link in an email.

The word is new enough that people search for how to say it. It rhymes with fishing, and it is just QR plus phishing squashed together. The difference between phishing and quishing is only the delivery: the payload is a URL either way, and the page at the end of it is the same fake login or the same fake payment form.

The name is silly and the objection is right

There is a post on r/cybersecurity that says, in full caps and with 451 upvotes behind it, that this is just phishing with QR codes and we should stop it with the weird names. That is a fair complaint. Nobody coined a separate word for phishing delivered by SMS banner or by calendar invite, and the industry's habit of naming every delivery channel does more for vendor slide decks than for anyone's inbox.

Two things about this channel are genuinely different, though, and they are worth naming even if the word is not.

You cannot hover a sticker. On a desktop, the oldest defence against a bad link is putting the cursor over it and reading the status bar before you commit. A printed code gives you nothing to hover, nothing to long-press, and no sender to check.

A code is an image. Filters that read the text of a message for known-bad domains have nothing to read when the domain is drawn in black squares. The URL is in there, but it is in a picture.

The advice everyone gives, and where it stops

Every article on this ends the same way: check the URL before you tap it. Law enforcement notices, bank warnings and security blogs all converge on that one line, which is why people searching for the FBI's guidance on QR codes find the same sentence everywhere they look. It is not wrong. It just breaks in two places, and nobody covers either.

The first break is that the preview is not guaranteed. There is a widely upvoted r/YouShouldKnow thread where the top comment says confidently that your phone already does this, that you scan and the link pops up. Six hundred and seventeen people agreed with it. Further down the same thread, people on current software said otherwise: one tested on an iPhone Air running iOS 26 and it opened the link directly, no preview at all. Another, also on iOS 26 with a 15 Pro Max, still got a button and no auto-open. Someone else reported that Samsung shows the link by default.

So the behaviour depends on the handset, the OS version, and most of all on which app is doing the scanning. A banking app, a parking app, or a scanner built into some other app is not the camera. It does not owe you a preview and often does not show one. Whatever your phone did the last time you tested it, that is one data point about one app on one OS build.

The second break is worse, because it happens even when the preview works perfectly. From the same thread, with 141 upvotes: it does not matter, because they are all link shorteners. A preview reading bit.ly/3xKq2 is not information. You have successfully checked the URL and learned nothing.

Someone in that thread also asked the obvious question: wouldn't decoding it still require scanning the QR code? On a phone, with the camera, yes. That is the part worth fixing.

Decode the image, don't scan the code

A man in a Luton car park found a fake sticker on the machine. Two other people were using it while he stood there. The clone was hosted on a .sbs domain while the real PayByPhone site is a .com, which is the kind of thing you can see instantly if you can see the URL at all. His partner asked exactly the right question: is it safe to scan the code just to find out what the URL is, so we can report it?

You do not have to. A QR code is not a link, it is a picture of a string. You can read the string without going anywhere.

1. Photograph the sticker with your camera app. Not the scanner, the camera. A photo is just a photo.
2. Open the QR Code Decoder and give it that image. It takes an uploaded file, an image pasted from the clipboard, or the URL of an image. The decoding runs in your browser through a ZXing WASM reader, so the picture is not sent anywhere and neither is the destination visited.
3. Read the domain in the result. Compare it to the domain printed on the machine, on your ticket, or on the operator's app. A .sbs where a .com belongs is the whole answer.

When the answer is a shortener

If step three hands you bit.ly/3xKq2, you have moved the problem rather than solved it. Paste it into the Redirect Detector, which requests the URL without following it automatically and lists what came back. For each hop it shows the hop number, the HTTP status code and status text, and the URL for that hop, then the final destination after the chain ends. It stops at ten redirects and tells you if the chain loops back on itself. The requests are made by the site's server, not by your phone, so your device never loads the page you are suspicious of.

That is all it reports. There is no timing, no latency, no reputation score, no verdict. What you get is the chain of addresses, and the last one is the address that would have taken your card number.

Sometimes the decoded string is not a clean URL either. If it carries a percent-encoded or Base64 blob with the real destination buried inside, the Decoder will unpack it: URL, Base64, JWT and a few others, each on its own tab.

The tell is almost always physical

Look at the real cases and the same object shows up in each of them.

In Ottawa it was a sticker on a meter. In Luton it was a sticker on a car park machine, at a car park where the top-voted joke in the thread was about official advice to look for the authentic logo, as if a logo were hard to copy. In New York a Citi Bike sticker was peeled off one bike and stuck onto another, so the rider unlocked a bike a scammer then kept for the day, and $160 went on the rider's account. In Covington, Kentucky, someone fitted a wheel lock to a car and left a window sticker with a QR code demanding a six-digit code, a licence plate, $415 to release the car, and $10 more to speak to a human. The most useful comment on that one was that parking tickets are not $415.

None of those needed a URL check to catch. They needed someone to look at the code itself and notice that it was a sticker, that it sat slightly proud of the surface, that its corner lifted, that it covered a printed panel, or that the amount it asked for made no sense for the thing it claimed to be.

So run the physical check first, because it costs nothing. Is this code printed into the machine or stuck onto it? Does an edge lift? Is there another code underneath? Then, if you still want to know where it goes, photograph it and decode the photo. The best comment on the Ottawa thread put the rule plainly: scanning a QR code should be thought of as the same thing as clicking any link in an email.