Sticker-over-sticker attacks, redirect chaining and homograph domains — plus why decoding before opening defeats all three.
A printed link can be read before it is visited. A QR code cannot: the destination is in the pattern, and most camera apps show only a domain, briefly, before opening it. The code also arrives with the authority of where it is printed — a parking meter, a restaurant table, an invoice — so people trust it more than an unknown email.
Sticker over sticker. Someone prints a code to a page they control and sticks it over a legitimate one: on a parking meter, an EV charger, a payment standee. The page asks for card details or a UPI PIN. Nothing about the code looks wrong.
Redirect chaining. The code points to a harmless-looking short link, which redirects to another, which redirects to the phishing page. Each hop can be on a reputable service, so a check of the first address finds nothing.
Lookalike domains. The final page sits on a domain that reads like the real one — a letter swapped, an extra word, or characters from another alphabet that look identical to Latin letters. These are called homograph or IDN domains.
The attack is not in the code. It is in the step where nobody reads the address.
For anyone scanning: read the full address before opening it, and be suspicious of any page that asks for a password, card number or UPI PIN after a scan. A UPI payment never needs your PIN to receive money. The QR scanner on this site decodes a code and shows the raw content and where the link finally goes, without opening it.
For anyone printing codes: check physical codes regularly for stickers, prefer tamper-evident labels, and print your domain beside the code so people can compare.
For a QR service: screen destinations when they are set and again later, and stop a code that turns malicious. Ours checks every destination against threat-intelligence lists when it is created or edited and re-checks active ones weekly; a destination reported as malicious is suspended automatically and shows a warning page instead. A new domain shows a caution page first, and lookalike hostnames are flagged for a person to review.
It gives no figures for how common quishing is.
No screening catches everything; reading the address yourself is the check that does not depend on anyone else.
Decode any QR code and read the full destination, every redirect, and whether it is flagged.