Quishing: Manipulated QR Codes & Fraud | IT-Medienrecht

QR codes are pervasive, simplifying access to websites, payments, and digital content. However, this convenience harbors a significant structural risk. Criminals exploit manipulated QR codes to steal data, gain unauthorized access, and authorize fraudulent bank transactions. This growing threat is now widely known as Quishing (a blend of "QR" and "phishing"), leading to substantial financial losses, particularly for users of classified ad platforms and private transaction systems.

Quishing: Understanding Risks, Protection, and Legal Aspects of Manipulated QR Codes

This article will explain how manipulated QR codes and Quishing operate, explore why conventional protection mechanisms like two-factor authentication (2FA) may be insufficient, and outline the legal challenges involved. Furthermore, we will provide practical advice on how individuals can effectively protect themselves and respond lawfully.

How Quishing Works Technically and Psychologically

Technically, a QR code is simply a coded URL. When a smartphone scans it, a link is automatically opened without the target address being visible beforehand. Attackers exploit this behavior by generating QR codes that link to deceptively realistic fake websites.

After scanning, victims often uncritically open a page that appears authentic and then enter access data, TAN codes, or personal information. In many cases, perpetrators go a step further, employing social engineering tactics. They create pressure situations—such as "release payment, otherwise the offer will expire"—to force a 2FA confirmation.

In contrast to classic phishing, where manipulated emails containing links are sent, Quishing involves distributing the "link" as a QR code. This distribution occurs via various channels, including messengers, advertising portals, printed flyers, stickers in public places, or direct correspondence. Consequently, Quishing attacks often happen in situations where users subjectively perceive the source as "safe," such as in chats with supposed buyers or sellers, or through personal messages.

Typical Attack Scenarios, Especially with Classified Ads

The risk of Quishing is particularly pronounced in classified ad trading and other peer-to-peer transactions. Several factors contribute to this heightened vulnerability:

• Initially, a seemingly trustworthy contact is established, often through a chat on a popular platform.
• The alleged buyer or seller then sends a QR code, falsely claiming it to be an official payment link, a shipping label, or a verification process.
• The victim scans the code and is redirected to a deceptively genuine login page, which mimics, for example, the login portal of a payment service.
• After entering access data or confirming a transaction, sensitive information is transferred to the perpetrators, or payment is unintentionally authorized.

A specific criminal tactic observed in classified ads involves using the QR code to create a false sense of legitimacy—for instance, asserting "This is the secure payment page." This occurs even though there is no direct connection to the actual platform. Such schemes frequently lead not only to financial losses but also to identity fraud and account takeovers.

Two-Factor Authentication (2FA): Protection with Limitations

Two-factor authentication (2FA) is frequently highlighted in legal and security advice. Its purpose is to ensure that access is granted only after two independent proofs are provided, such as a password combined with an additional code or a push confirmation.

Fundamentally, 2FA reduces the risk that a stolen password alone can grant unauthorized access to an account. However, in practice, two main weaknesses persist:

1. Social Aspect: If a user is prompted to approve a transaction via a fraudulent credential, they are consciously and actively confirming the action, albeit under deception. In such cases, the 2FA mechanism is not technically "circumvented"; rather, it is performed by the victim themselves.
2. Technical Characteristics of 2FA: The phishing resilience varies significantly depending on the type of second factor used:
   • With SMS-TAN or time-based app codes, the generated code can be directly entered into a fake page.
   • Push confirmations in banking apps are particularly deceptive: they appear on the legitimate device and are often confirmed without the user fully comprehending the implications.

Only 2FA methods with cryptographic binding to the legitimate domain, such as security keys compliant with the FIDO standard, significantly mitigate this risk. However, these advanced methods are not yet universally supported by many services.

Prevention Strategies: Beyond Technical Mechanisms

While technical protective measures are crucial, they alone are insufficient. Legal advice and cybercrime prevention therefore emphasize a comprehensive approach combining technology, user awareness, and established process rules:

• Always treat QR codes as external links. Whenever possible, check the target URL before opening it, for example, by using a preview function or a QR scanner that displays the URL.
• When conducting financial transactions, it is a duty of care to initiate payments exclusively through the official websites or apps of the respective payment service or platform.
• Avoid confirming a 2FA request instinctively. Instead, always verify the specific purpose, transaction details, and context of the request.
• Consistently avoid "off-platform" links. Reputable providers offer their own secure workflows for transactions.
• In public spaces, be aware of manipulated QR codes (known as "overstickers"). Warning signs include visible overlays, crooked placement, or stickers affixed over existing codes.

These preventive measures offer not only technical safeguards but also bear significant legal relevance. In any liability or reimbursement proceedings, the assessment will include whether the affected person could have recognized typical warning signals or if they breached their duty of care. Meticulous documentation of the incident and one's own actions is therefore critical.

Legal Classification: Reimbursement, Liability, and Gross Negligence

Should an unauthorized payment occur, the legal basis for recourse primarily falls under payment services and banking law, specifically Sections 675u et seq. of the German Civil Code (BGB). The general claim for reimbursement of unauthorized payments is established in Section 675u BGB. This regulation mandates that the payment service provider must refund the unauthorized amount without delay.

Conversely, Section 675v BGB permits the payment service provider to reduce or refuse liability in instances of gross negligence on the part of the customer. The determination of whether a behavior constitutes gross negligence depends heavily on the specifics of each individual case. The limited case law in this area consistently highlights that obvious security breaches or the disregard of explicit warnings signify a grossly negligent breach of duty.

For those affected, this means that even when technical manipulations are involved, the resolution of a dispute does not hinge solely on the presence of deception. Instead, it critically examines whether the security breach was objectively recognizable and whether the individual adhered to ordinary standards of care. Comprehensive documentation of the incident and personal actions is crucial in such situations.

What to Do if You Are Affected?

In the event of an actual or suspected Quishing attack, a structured and swift approach is highly recommended:

1. Immediately Halt Transactions: Stop all payment transactions, change access data, and update relevant passwords without delay.
2. Inform Bank/Payment Service Provider: Contact your bank or payment service provider to arrange for accounts and cards to be blocked.
3. Apply for Reimbursement and Document Lawfully: Submit a timely written declaration to the payment service provider, providing all available evidence.
4. File Criminal Charges: Lodge a criminal complaint with the police for fraud or phishing/Quishing; secure all evidence pertinent to the incident.
5. Communicate with the Platform: Inform providers of classified ads or web services about the incident to help prevent further damage and protect other users.

This procedure not only serves to limit potential damage but can also be of decisive importance in the context of any subsequent legal disputes.

Conclusion

The combination of visual credibility, mobile convenience, and a lack of URL transparency makes manipulated QR codes and Quishing a significant threat. This is particularly true in contexts involving transactions between private individuals. Traditional security mechanisms like two-factor authentication are important, yet they are no substitute for critical examination, conscious action, and adherence to prudent rules of conduct.

When in doubt, it is always advisable to process transactions exclusively through official workflows and to refrain from scanning ambiguous QR codes. Instead, act directly via the legitimate app or browser. In an emergency, affected individuals must act swiftly to protect their legal claims and professionally address potential liability issues. These proactive steps are vital for effective damage limitation and legal clarity.