Phishing, smishing, and vishing are all means by which crooks attempt to separate us from our money and sensitive information. Now you can add “quishing” to the list.

In the early days of phishing, crooks tricked consumers via emails into providing personal or financial information in response to some urgent problem, such as fraud being detected on a bank or credit card account. These days, simply clicking on links or attachments in messages can download malware.

Smishing is similar to phishing except that the fraudulent message arrives via text. Vishing is the use of fraudulent phone calls, often prerecorded robocalls, to scam people. Phony auto warranties are commonly peddled through vishing.

QR codes have become very popular for scanning menus at restaurants, getting into a concert, boarding a flight, and performing a host of other functions. You simply scan the QR code with the camera in your phone to read a document, link to a website or app, or gain entry to a venue or flight.

The newest “ing” scam is “quishing,” which is perpetrated through fraudulent QR codes that crooks can easily create online. They often come in unsolicited messages or are posted in a public place. Crooks count on consumers thinking they’re harmless, not inspecting the website they’re taken to, and/or acting without thinking in response to an urgent message. You may be taken to a spoofed website that looks real and have information you enter used for identity theft or have malware downloaded to your device.

A common quishing scam that the BBB, FTC, and police have warned about involves scammers covering up QR codes on parking meters with their own malicious stickers, or even putting stickers on meters without QR codes that victims will assume are a convenient way to pay. Scanning the code takes the person to a phony website that gathers credit card and other personal information for nefarious purposes. Plus, the parking fee hasn’t really been paid, leading to other unhappy consequences.

Local consumers have filed reports with our BBB Scam Tracker service about government impostor scams in which they’re instructed to scan a QR code that takes them to what is supposedly a government website. One consumer reported receiving a message that bank accounts had been compromised with instructions to click on a QR code to move money to a secure cryptocurrency account. Fortunately, none of them fell for the scam, but the crooks wouldn’t bother sending such messages if no one fell for them.

The BBB and FTC offer these tips to protect yourself from quishing:

• If you see a QR code in an unexpected place, inspect the URL before you open it. If it looks like a URL you’re familiar with, make sure it’s not spoofed – look for misspellings or a switched letter.
• Don’t scan a QR code in an email or text message you weren’t expecting – especially if it urges you to act immediately. 
• If you’re scanning a QR code in a public place, like a restaurant, make sure the QR code isn’t on a phony sticker placed by a crook.
• Update your phone’s operating system to protect against hackers and protect your online accounts with strong passwords and multi-factor authentication.