QR Code "Quishing" Scams

Are you or your kids big soccer fans? If you are, you probably have the upcoming 2026 FIFA World Cup on your radar. With Canada hosting the cup this upcoming year, it gives us Canadians the opportunity to buy tickets to see our favourite teams play live.

With millions of fans eager to secure a coveted ticket, the competition is fierce and many people may resort to any means possible to get their hands on some tickets. Unfortunately, with such a high demand for tickets, scammers are looking for any opportunity to take advantage of unsuspecting buyers.

So far, over 4,300 FIFA-themed domains have been registered by scammers, mimicking ticketing, queue, and merchandise sites. They offer fake websites, fake “priority access” links, and even fake customer-support accounts on social media. A few families in Canada have already reported being tricked by look-alike ticket pages asking for credit card info or login credentials.

One method scammers have started using to make things look even more legitimate is using QR codes. They post these codes in social media groups, fan pages, and comment sections, claiming things like: “Reserve your ticket early”, “Exclusive pre-sale access for Canadian fans” or “Discounted family packages”. When someone scans the QR code, it leads to a phishing page designed to steal personal info or payment details. It’s basically phishing with a QR code twist (sometimes called Quishing).

QR codes, or quick response codes, are a type of bar code that's scannable by digital devices like smartphones through their camera lens. They typically contain information, such as a link to a website (a URL). Because they do not show the link they are sending you to, scammers are able to mislead people and hide malicious URLs (website address) behind QR codes.

Last year the Canadian Centre for Cyber Security issued a warning in a publication on security considerations for QR codes, saying there's a potential for scammers to “leverage QR codes to infect devices with malware, steal personal information, or conduct phishing scams".

Quishing QR codes could take you to fake websites that imitate the look of a real website, but aren't. Any information you enter into this site, whether that is passwords, personal identification information, or banking information, can be stolen and abused by scammers. Alternatively, the QR code could install malware onto your device and steal your information before you realize what is happening.

A few simple ways to stay safe:

• Like many phishing scams, a sense of urgency is always a red flag to look out for (for example, a QR code to buy last minute tickets to a concert or the World Cup). Remember, scammers rely on you being in a hurry and not slowing down to think about what you are doing
• If possible, carefully check the URL of where the QR code is sending you. Even if it looks like a URL you recognize, always check to make sure it’s not spoofed (look for any misspellings or switched letters). If you are unable to see the URL, avoid scanning the code altogether if possible
• Stick to official channels (like FIFA.com) for tickets or updates
• Avoid scanning QR codes that come from random posts, images, unknown senders, or forwarded messages
• If you create a QR code to share with others, include the URL (website address) underneath the code to let people know where it should take them
• Be cautious of anything promising early access or guaranteed tickets
• Use a credit card for any purchase (easier to dispute charges)
• If you think you have scanned a malicious QR code, contact the police 

At the end of the day, the number one thing you can do to keep your kids and family safe is investing in cyber education. If kids can learn about all the tricks being used by scammers, they will be much better prepared to handle these situations safely. 

Our Trustee Shield course goes into depth about the different types of phishing tactics scammers use, equipping kids with the skills and knowledge they need to defend against scammers! To register for our courses, check out our website here:  https://kidsshield.ca/services/shields

Also check out our CyberScanners game, which is designed to be a fun and engaging way for kids to test their knowledge of phishing scams! You play as a security bot in charge of filtering emails, texts, social media posts, and QR codes in order to keep their recipients safe from phishing scams. Check out our games on the app store or on our website here: https://kidsshield.ca/services/game

Be Educated. Be Connected. Be Safe.