4 ms·
Organised gangs behind rise in QR 'quishing' scams
- tveyben 2y agoWhy not a short URL where one can at least read the domain name and see if it looks reasonable before progressing with whatever the task ($£kr) is
- varenc 2y agoEven seeing the domain name doesn't solve the fundamental trust problem. A malicious actor could post a fake QR code or fake short URL leading to "city-parking-secure.com" or similar legitimate-looking domain. The real solution is establishing a trusted channel - citizens need to know they should only pay for municipal parking through their city's official domain (e.g., sf.gov/parking). But this isn't possible when it's some random parking company. I don't see a great solution.
- HPsquared 2y agoThe parking company could use a subdomain, say parking.sf.gov
- creatonez 2y agoThat could help, as `.gov` can only be registered by the US government. But... a lot of the millennial and gen X generation have misguided beliefs about the trustworthiness of TLDs. Such as thinking `.com` is more trustworthy than `.net` under the assumption that it can only be registered by a real company. I'm convinced the only responsible solutions are chip-only payment processors and conventional coin machines, as pricey as they are.
- shaunkoh 2y agoHow do you protect yourself from this? Treat public QR codes like "free" USB drives – don't use them?
- Arch-TK 2y agoThe same way you might treat a URL randomly written on a billboard. Barring vulnerabilities in your QR reader, it should be enough to just read the URL.
- varenc 2y agoand how do you know the real parking company's URL is 'city-secure-parking.com' and not 'express-city-parking.com'?
- tgsovlerkhgsel 2y agoCall the city to verify. If enough people do it, they'll find a way to solve the problem (e.g. a subdomain of the official city site, putting back regular parking meters/machines, ...)
- jdietrich 2y agoA lot of these car parks are privately owned, so the local authority will reasonably respond by saying "nothing to do with us mate".
- tasuki 2y agoYou don't. But the problem is not the QR code. The problem is the same as "URL randomly written on a billboard".
- blueflow 2y agoI think the term you two look for is "Lack of Authentication". The QR codes are not authenticated to the reader.
- Arch-TK 2y agoI mean in this case I would recommend using a search engine to cross-reference, and any other phishing countermeasures you might normally use. I think the situation is dire when it comes to non-technical users, but I don't think QR codes are the problems here, someone could equally well paste a sticker over the entire board with all the URLs replaced or with details of a completely different (fake) parking company (but I agree replacing QR codes probably makes it harder for an employee to spot).
- bsder 2y agoHey, guys, I have this crazy idea. How about we have people give small bits of paper to other people to pay for things? Or maybe even wave small cards of plastic in front of things that can read them? Maybe how about not using my fucking phone for every goddamn thing? Crazy, right? KTHXBYE.
- Arch-TK 2y agoThese are all too insecure in 2025. Everyone knows that phones are impenetrable fortresses which only one person can ever access, and nobody has ever been mugged into transferring money to someone else using their phone.
- tou23 2y agoThose have lots of security problems too.
- bsder 2y agoStealing my wallet is generally worth less than stealing my phone even before you take into account the value of the data and the grief and expense of replacing my phone. The fact that parking systems won't install wireless credit card readers and instead will foist the externality onto me of 1) having a phone, 2) that is currently charged, 3) has a relatively high resolution camera, and 4) capable of high bandwidth internet access is the kind of thing that ticks me off.
- pjc50 2y agoThe divisibility of cash is fiddly and handling and counting it is not free. Both customers and businesses like switching to card. The sweet spot is probably around contactless, but eventually more countries will get things like Vipps or WeChat pay and it will become a unified experience.
- somerandomqaguy 2y agoThe parking garage one can be really insidious. The parking apps where I live in Canada have a terrible design; you absolute cannot start parking session without an account that requires you to input name, address, phone number, and then the app itself has other technical glitches that genuinely made me wonder if I had been scammed. What makes it doubly so is that the parking companies have been removing the parking machine terminals in some locations. The Royal BC Museum in Victoria BC comes to mind last time I was there. I'd be surprised if someone hasn't at least tried a QR code scam on it by now.
- ilrwbwrkhv 2y agoI never pay parking if a machine isn't there. I've never been caught. And if I'm ever fined I'm taking that all the way to court. One must have extreme disdain for such things.
- Arch-TK 2y agoThat's just all parking apps in my experience. The websites (if they exist) are usually about as bad. Car parks make more money if they can fine you, so there's no incentive to make payment easy or make it work reliably.
- XorNot 2y agoCar parks in Australia just have credit card NFC terminals which are provided by the banks.
- HPsquared 2y agoOh damn I never realised that. There is a class of services where they want to make payment difficult to collect penalties.
- trilbyglens 2y agoCitymove in Prague works really well and has great design ;)
- avastmick 2y agoHaving lived in China for five years and seeing how it is done there (literally everywhere), I see this as a payment problem. There is no sensible, low cost payment infrastructure to support this safely. Instead most of the west has a fractured app ecosystem where each app ‘does payment’ rather than via a set of trusted payment apps that do the security up front and then passes to the provider. For example, in the article the photos show an anonymous QR code you’d scan with your camera, rather than in China where you’d use Alipay or WeChat, whose app you’d use to scan the QR. When I returned from China, it took a while to readjust to the heightened (and often expensive) friction of payments. Not saying scams don’t exist in China, just that the payment provider gives some guarantees on the veracity of the claim made by the QR code
- beeflet 2y agothey could just put a QR code of a different wechat account
- tokioyoyo 2y agoSince it's all tied to real IDs, wouldn't that involve heavy risks from the scammer's side? I know it's possible, but still a bit less risk if your Scam HQ operates overseas.
- beeflet 2y agoI suppose, but you could say the same about bank transfers in the west
- gambiting 2y agoYes, so worst case you paid a little bit of money to the wrong account. This is much worse - usually the QR code leads you to an app that then authenticates with your bank and can transfer and arbitrary amount of money out.
- beeflet 2y agoThe problem I think is with the bank. They don't give you a way to authorize a single payment or authenticate yourself without just giving away total access to your funds. It should be like cryptocurrency where there is a separation of the public and private key. Or even better, something like chaumian e-cash. I feel like that would pretty much shut down the majority of financial crime.
- hargup 2y agoWas wondering why such scams are not a thing in India (yet?), and realized there is always a person next to the QR to verify the payment. So such QR quishing scams are much harder to pull off. [Not saying there are no scams in India. Just that QRs for payments are very popular here as well, and scammers are smart and active, so was wondering why not]
- 0xEF 2y agoCan we stop making new -ishing words for scams? This weird lingo is part of what turns the less savvy users off from paying much attention to their personal security. Just say a [type of] scam such as "a QR code scam" or "text message scams," etc. We do not need to coin a new term for each one of these things and nobody is winning any prizes for adding more layers of abstraction to fight through when trying to communicate security concepts to the people who really need to listen to it.
- hackable_sand 2y agoThe delineation is useful for broad audiences.
- 0xEF 2y agoAs someone who regularly has to digest relevant security information and deliver it to teams that generally do not know a lot about or do not enjoy using computers, I can tell you that no, it is not useful.
- SapporoChris 2y agoI am in full agreement. However, it seems to be human nature to make portmanteau words, acronyms, abbreviations and slang. All of my attempts to outlaw these things and impose fines have fallen on deaf ears. I must also confess that I have used these terrible words...
- RossM 2y agoIt's got to be pure marketing - the British media certainly loves a buzzword, but I suspect that's more to do with their clickbait strategy. ("What is blishing? Have I fallen for it?"). Perhaps it helps some people compartmentalise, but I couldn't find any research that looks into any increased cognitive load. Our workplace cybersecurity training introduces at least 1 new word each year. This year's was "vishing" which apparently is just social engineering/credential extraction that takes place over the phone. Of course, it's presented to non-technical users as a well-adopted term that is very important to know (for the checkbox quiz in 3 slides time).
- jdietrich 2y agoThe government saw the basic problem in 2019 - a fragmented market with over 30 different parking apps - and funded a pilot to create a single unified parking payment platform. Unfortunately, the new government isn't interested in supporting the project further. https://npp.org.uk/ https://npp.org.uk/ https://www.theguardian.com/money/2025/feb/22/uk-wide-parking-app-out-of-road-government-funding-withdrawn https://www.theguardian.com/money/2025/feb/22/uk-wide-parkin...
- mytailorisrich 2y agoWhy do we need an app to pay for parking? I think that's the real question.
- echoangle 2y agoWhat’s the alternative? Machines to pay are much more expensive than a sign with a QR code.
- mytailorisrich 2y agoYou don't need an app to accept online payments. There are indeed pay machines, and removing them is only a profit-squeezing play by the operators. You also never need the QR code. It's only provided as a "convenience". And in fact they usually also provide a way to pay by phone (see illustrative picture in article). So these are all issues created by bad engineering and operators trying to squeeze as much as they can without consideration for the users.
- echoangle 2y ago> You don't need an app to accept online payments. Right, but does it matter if it’s an app or a website? > There are indeed pay machines, and removing them is only a profit-squeezing play by the operators. Yes, and? > You also never need the QR code. It's only provided as a "convenience". And in fact they usually also provide a way to pay by phone (see illustrative picture in article). Of course you don’t need a QR code specifically, but you probably need some kind of URL (which can then be imitated by the scammer) so everyone can pay. > So these are all issues created by bad engineering and operators trying to squeeze as much as they can without consideration for the users. I wouldn’t call it bad engineering, it’s a tradeoff. Either expensive machines for every parking space or a simple sign with a QR code.