Quishing: Spot Fake QR Codes on Your Burnaby Storefront

A QR code is just a picture of a web address. That's what makes it handy on a counter display, and it's also what makes it easy to abuse. Nobody can read a QR code by eye, so a sticker slapped over yours looks exactly like the real thing until a customer's money lands somewhere else.

That trick has a name: quishing, short for QR phishing. Here's what the official guidance says about it, how to check your own storefront in about ten minutes, and where AI tools help (and where they don't yet).

What quishing actually looks like

The Canadian Centre for Cyber Security groups QR attacks into a few patterns in its awareness sheet ITSAP.00.141 (page last modified January 2024). The ones that matter most for a shop:

• Cloning: replacing an authentic code with a malicious one, usually a sticker over yours.
• Fake sites: sending people to a fake site that steals logins or installs malware.
• Advertising: posting malicious codes in public spaces.
• Quishing in messages: putting a code inside a phishing email so the link slips past a quick glance.

The FBI flagged the storefront version early. Its January 18, 2022 public service announcement, Cybercriminals Tampering with QR Codes to Steal Victim Funds (alert I-011822-PSA), warns that criminals swap physical and digital codes to redirect payments and capture financial details.

It isn't only an American problem. In August 2025, B.C. RCMP in Penticton warned of a national scam using "fake QR codes placed on or near parking meters, signage, or pay stations," and noted the city's official parking app "does not use QR codes for payment." Parking is the headline example, but the same sticker works on a café table tent in Burnaby or a tip jar in New Westminster.

Why your storefront is a target

Your customers trust your counter. That's the whole attack. A fake code on a random lamppost gets ignored, but one taped to your menu stand or invoice inherits your reputation.

The damage lands on you even when your systems were never touched. A customer who pays a fake page blames the shop. And because the sticker looks legitimate, you might not notice for days.

A ten minute quishing check for your shop

None of this needs special software. It needs a routine.

1. Inventory every code you've put out. Menus, table tents, window decals, receipts, invoices, business cards, delivery bags. Write down where each one points. If you can't say where a code goes, that's your first problem.

2. Feel for stickers. The FBI advice is blunt: if you're scanning a physical code, "ensure the code has not been tampered with," such as a sticker on top of the original. Run a finger over every printed code at opening. A raised edge is a red flag.

3. Scan your own codes and read the address. Use your phone's built in camera, not a random scanner app. The FBI specifically says not to download a QR scanner app because most phones already have one. Check that the domain is yours, spelled correctly, with no swapped letters.

4. Use short, readable domains. If your code points to a long tracking link from a third party, customers can't tell real from fake. A code that resolves to your own domain gives them something to check against.

5. Print the address next to the code. The Cyber Centre says typing a URL is safer than scanning, for example for a restaurant menu. Give people that option.

6. Don't make QR the only way to pay. The FBI recommends people avoid paying through a site reached by a QR code and instead type a known, trusted address. If your checkout depends on a code, offer a tap terminal or a typed link too.

7. Tell staff what to say. The Cyber Centre advises customers to ask staff to verify a code that may be covering another one. Your team should know the answer, and know to pull a suspicious sticker and photograph it.

The email side: codes aimed at you

Quishing doesn't only target customers. Owners get it too, through fake invoices, "your account is locked" notices, and delivery alerts.

The FTC's December 6, 2023 consumer alert says not to scan a QR code in an email or text you weren't expecting, especially one that pushes you to act right away. If it might be real, contact the company using a number or website you already know. The FTC also recommends keeping your phone's operating system updated and turning on multi factor authentication.

The FBI adds a useful rule for suppliers: if a company says a failed payment can only be completed through a QR code, call them using a number from a trusted source, not one in the message.

Where AI fits, and where it doesn't yet

You'll see plenty of claims that AI will "solve" quishing. The research is promising but early, so here's the honest version.

A 2025 arXiv paper by Fouad Trad and Ali Chehab, Detecting Quishing Attacks with Machine Learning Techniques Through QR Code Analysis, tried to spot phishing codes from the image's structure alone, without opening the link. Their best model, XGBoost, reached an AUC of 0.9106, rising to 0.9133 after removing uninformative pixels.

That's interesting, but read the fine print. Per the paper itself, the 9,987 codes were generated in software from a URL dataset, all at one QR version and fixed settings. The authors say the study "operates under controlled conditions" and list testing codes photographed in real lighting, with distortion and printouts, as future work. In other words, nobody should be pointing a phone at a sticker and trusting a model's verdict yet.

Where AI is more practical today is in reducing how often customers need a QR code at all. An AI receptionist or booking assistant can text a customer a link on your own domain after a call, so the link comes from a number they just spoke with rather than a sticker anyone could replace. That's not a security product. It just means fewer unattended codes on your counter.

Where this doesn't apply

Be realistic about the limits here.

Physical checks beat software. The most effective defence in every source above is a person looking at the code and the address. No tool replaces a morning walk around the shop.

Some guidance is aimed at consumers, not businesses. The Cyber Centre sheet has no section addressed to organizations. Most of the shop advice here is adapted from consumer tips, so treat it as sensible practice, not a regulatory checklist.

You can't police every code. Stickers on the sidewalk, a neighbour's window, or a parking meter outside are out of your control. Report them, but don't take them on as your job.

If you only have one code, automation is overkill. A small shop with a single menu code needs a daily glance, not an AI system. Spend the money elsewhere.

Detection research isn't a product. The 0.91 AUC above comes from synthetic codes in a lab. It hasn't been shown to hold up on crumpled, glared, real world stickers.

If something's already gone wrong

If a customer paid through a fake code, the RCMP advice is to contact their financial institution right away and report it to police. The Cyber Centre also points people to local police and the Canadian Anti-Fraud Centre. Photograph the sticker before removing it. That photo helps police and helps you warn other Metro Vancouver businesses.

Sources

• Canadian Centre for Cyber Security. Security considerations for QR codes (ITSAP.00.141). 2024. https://www.cyber.gc.ca/en/guidance/security-considerations-qr-codes-itsap00141
• Federal Bureau of Investigation, Internet Crime Complaint Center. Cybercriminals Tampering with QR Codes to Steal Victim Funds (I-011822-PSA). 2022. https://www.ic3.gov/PSA/2022/PSA220118
• U.S. Federal Trade Commission, Alvaro Puig. Scammers hide harmful links in QR codes to steal your information. 2023. https://consumer.ftc.gov/consumer-alerts/2023/12/scammers-hide-harmful-links-qr-codes-steal-your-information
• Royal Canadian Mounted Police, B.C. Penticton RCMP warn residents of national QR code parking scam. 2025. https://rcmp.ca/en/bc/news/2025/08/penticton-rcmp-warn-residents-national-qr-code-parking-scam
• Trad, F. and Chehab, A. Detecting Quishing Attacks with Machine Learning Techniques Through QR Code Analysis. arXiv:2505.03451. 2025. https://arxiv.org/abs/2505.03451

Want fewer loose QR codes on your counter and a cleaner way to send customers links they can trust? Book a free call with Autana and we'll walk through what makes sense for your shop, including when the answer is "don't automate this yet."