LEGALAUDIT

Scam Radar

How can you recognize Quishing — manipulated QR codes at parking machines and charging stations?

Published

TLDR

Fraudsters stick fake QR codes over the real codes on parking machines (EasyPark, PayByPhone) or charging stations (EnBW, Ionity). The scanned code leads to clone pages that capture credit card data and 3 D Secure codes. Indicators: 1)...

How it works

Fraudsters stick fake QR codes over the real codes on parking machines (EasyPark, PayByPhone) or charging stations (EnBW, Ionity). The scanned code leads to clone pages that capture credit card data and 3 D Secure codes. Indicators: 1)...

Red flags

  • Urgent pressure to click, pay, or share codes immediately.
  • A link or sender that does not match the official organization.
  • Requests for card data, passwords, OTPs, wallet signatures, or bank transfers.

What to do

  1. 1Indicators: 1) Sticker visibly pasted over the original; 2) URL ends with .top, .icu or contains a typo; 3) Immediate payment demanded without app verification; 4) CVV and SMS TAN requested.
  2. 2WHAT TO DO: Only use the provider's official app, never scan a QR code on a street machine.
  3. 3IN CASE OF FRAUD: Block the card via 116 116, file a report with BSI via buerger cert@bsi.bund.de.

Source

BSI

Source reviewed by Mythos Forensic Team

https://www.bsi.bund.de/DE/Themen/Verbraucherinnen-und-Verbraucher/Cyber-Sicherheitslage/Methoden-der-Cyber-Kriminalitaet/Quishing/quishing_node.html

FAQ

Is Quishing — manipulated QR codes at parking machines and charging stations a real scam pattern?

Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.

What are the first warning signs?

Urgent pressure to click, pay, or share codes immediately.; A link or sender that does not match the official organization.; Requests for card data, passwords, OTPs, wallet signatures, or bank transfers.

What should I do first?

Indicators: 1) Sticker visibly pasted over the original; 2) URL ends with .top, .icu or contains a typo; 3) Immediate payment demanded without app verification; 4) CVV and SMS TAN requested.; WHAT TO DO: Only use the provider's official app, never scan a QR code on a street machine.; IN CASE OF FRAUD: Block the card via 116 116, file a report with BSI via buerger cert@bsi.bund.de.

Can LegalAudit check my case?

Yes. Start a free chat and paste the message, link, sender, or payment details for triage.