Quishing: BK and OeNB warn of QR code fraud

How the scheme works

How the scheme works

In quishing, conventional phishing links are replaced by QR codes. The codes may appear harmless at first glance, but can be just as dangerous as fraudulent links. Anyone who scans the code with a smartphone is directed to a fake website where personal data, login credentials or payment information are requested. Since QR codes do not visually reveal where they lead, the threshold for acting without thinking is particularly low.

Assessment by the Federal Criminal Police Office

Assessment by the Federal Criminal Police Office

Andreas Holzer, Director of the Federal Criminal Police Office, explained the perpetrators' tactics: "Kriminelle setzen darauf, dass Menschen aus Gewohnheit schnell scannen und handeln." The Federal Criminal Police Office classifies quishing as a new variant of known phishing and treats it as a serious threat to payment transactions. The authority advises that unexpected messages containing QR codes should always be treated with suspicion.

Position of the Oesterreichische Nationalbank

Position of the Oesterreichische Nationalbank

OeNB Director Josef Meichenitsch warns of typical warning signs: "Wenn E-Mails mit QR-Code unpersönlich formuliert sind, wenn Druck aufgebaut wird oder wenn man persönliche Daten preisgeben soll, dann ist Vorsicht angesagt." Petia Niederländer, Director of the OeNB's Payments, Risk Monitoring and Financial Education Main Department, adds: "OeNB und BMI setzen gemeinsam auf Information und Prävention, um vor Betrugsmaschen wie Quishing zu schützen." The Nationalbank emphasises that attentiveness and caution are the most effective tools against quishing.

Comparison with classic phishing

Comparison with classic phishing

As with conventional phishing, the rule is that unexpected emails or letters should be treated with the greatest suspicion. What is new, however, is that the perpetrators replace the first step – clicking on a link – with scanning a QR code. Many smartphone users are accustomed in everyday life to scanning QR codes in restaurants, at ticket machines or on posters, and transfer this routine unchecked to messages of unknown origin.

Recommended behaviour

Recommended behaviour

Both the Federal Criminal Police Office and the OeNB advise against scanning QR codes out of curiosity when they appear in unsolicited messages. Red flags such as impersonal salutations, time pressure or requests to enter personal data are considered clear warning signs. When in doubt, the message should be ignored and, if necessary, reported to the bank or the police.

Joint prevention strategy

Joint prevention strategy

With the joint warning, the Federal Criminal Police Office and the OeNB are pooling their awareness-raising efforts. The Oesterreichische Nationalbank points out that prevention is a central component of financial education. The Federal Criminal Police Office announces that it will continue to monitor the development of the scheme and provide further information as new findings emerge.