Quishing

Why it is effective

1. Nobody can read a URL from a pattern of squares. Every other phishing channel gives the target something to inspect.
2. It moves the victim to a phone, which is usually outside corporate protection, no endpoint agent, no proxy, a truncated address bar.
3. Email filters scan text, not images. A QR code in an attachment or an inline image frequently passes filters that would have blocked the link.

The common physical form

A sticker placed over a legitimate code, on a parking meter, a restaurant table, a charging point, a payment standee. The attack requires no technical skill at all.

Defences that work

• Check the URL on the preview screen before opening. Both iOS and Android show it.
• Look at the code physically. A sticker over a printed code has an edge you can feel.
• Never scan a code that arrives in an unexpected email, especially one claiming to be MFA re-enrolment.
• Treat "scan to receive money" as a scam, always. Payment codes initiate payments from the scanner.
• For businesses: print the payee name large, and check your standees daily.