Rising "Quishing" Scams Prompt Warning from Banks and Regulators

Banks including Santander, HSBC, and TSB have joined forces with the UK National Cyber Security Centre (NCSC) and US Federal Trade Commission among (FTC) others to raise alarms over a surge in QR code phishing scams, also known as “quishing”. The scams are slipping through corporate cyber defenses and increasingly deceiving customers into divulging their financial details.

This new type of email scam involves criminals sending QR codes in attached PDFs. Experts highlight that these messages often bypass corporate cybersecurity filters, which typically flag malicious website links but do not scan images within attachments. According to IBM research, phishing attacks are becoming more costly for companies, with the global average cost of a data breach rising nearly 10% to $4.9 million in 2024.

QR codes contain data such as URLs or payment information in binary code. Although most smartphones display a short preview of the URL contained in a scanned QR code, researchers have noted that this pop-up is generally insufficient for users to detect potential fraudulent links. A survey by security software company McAfee in May found that more than a fifth of all online scams in the UK likely originated from QR codes. Reports of QR code scams in the UK more than doubled in the year to August 2024, according to Action Fraud.

The FTC and multiple local authorities across the UK have also warned this year about specific "quishing" scams targeting drivers. In some cases, stickers directing users to fraudulent sites have been placed over legitimate QR codes used for parking payments. These fraudulent links may direct users to incorrect websites, ask them to enter their details or lead them to download malware. Victims have also reported fraudulent QR codes being placed over legitimate ones at EV charging points, train stations, and restaurant tables.

Researchers emphasized that "quishing" scams are most commonly deployed via email, putting corporate security vendors under pressure to adapt their online defenses.

(Source: Financial Times)