France’s National Cyber Unit recently flagged over 800 open cases involving QR phishing (“quishing”) on public EV charging stations. Scammers slap a printed sticker over the legitimate operator’s QR code, drivers scan to pay for a battery charge, and end up on a cloned payment site that scrapes their credit card details—leaving them out of pocket and stranded with a low battery.
The physical sticker trick is about as low-tech as social engineering gets. What bugs me isn’t the sticker itself, but how blindly iOS and Android hand off execution of raw QR payloads directly to system services.
The Speed-Over-Safety Trade-Off
When you scan a QR code in the wild, the native camera app prioritizes zero friction above all else. The sequence happens in milliseconds:
- The camera sensor captures the matrix and passes the string to the OS parser.
- The preview UI surfaces a heavily truncated snippet—usually just a top-level domain like
checkout-gateway.comor a shortened URL. - The user taps the pop-up banner, treating it like a trusted system link.
- The OS immediately hands off execution to Safari or Chrome, opening a socket, firing off requests, executing JavaScript, and setting session cookies before the user even sees the full URL bar.
In a scenario like this—paying for power on a rain-slicked curb—the user gets no useful signal before their browser loads the page.
The Missing Preview Layer
If the OS actually exposed the underlying payload structure before launching the browser, the attack vector collapses.
A savvy user scanning a legitimate charger might expect operator-fr.com. But if the preview surfaced the raw URL string, they’d see:
That domain structure raises an immediate red flag.
Even worse are shortened links. When a sticker encodes a URL shortener, native camera apps display tinyurl.com/fr-ev-charge without resolving where it points. If the OS unrolled the redirect chain in the preview UI:
The driver gets actionable telemetry before committing to the tap.
The Same Old Web Scams, Now Auto-Executed
The core issue here isn’t a brand-new threat vector; it’s the exact same web-layer obfuscation we’ve dealt with for decades in phishing emails and SMS attacks. The difference is that mobile OS camera integration stripped away the friction that used to give users a chance to spot the scam.
When an attacker sets up a physical quishing trap, they rely on the same URL tricks that plague desktop web security:
- Redirect Chains & Shorteners: A sticker encodes
tinyurl.com/fr-ev-chargeor a custom shortener. Native camera apps display the shortener host, hiding the target destination (phish-gate.com/login) until the browser has already executed the request chain. - Subdomain Padding & Visual Truncation: Scammers register domains like
operator.com.checkout-gateway.ru. Because mobile screens have limited horizontal preview space, the OS preview truncates the tail end, leaving the user seeing onlyoperator.com…and assuming it’s legitimate. - Homograph & Punycode Attacks: Attackers register internationalized domain names (IDNs) using Cyrillic or Greek characters that visually mirror Latin letters (e.g., swapping a Latin ‘e’ for a Cyrillic ‘е’). To the human eye in a native camera preview, the domain looks identical to the official operator site, bypassing visual inspection entirely.
- Brand Spoofing & Lookalike Typosquatting: Slight spelling alterations (
pay-operater-fr.comvspay-operator-fr.com) buried inside complex URL parameters that get completely hidden by default camera pop-ups.
In an email, an alert user might hover over a hyperlink, inspect the raw URL string, or rely on browser-level warning banners before clicking. But when scanning a physical QR code, the mobile camera acts as an eager execution engine, automatically feeding untrusted, obfuscated strings directly into the browser without offering any front-end prevention signals.
Fixing the Execution Boundary
Standard advice telling drivers to “inspect the physical sticker for peeling edges” or “look closely at the domain after the browser opens” is broken. Security advice cannot rely on human vigilance during a 2-second physical interaction in a parking lot. We’ve seen this movie before, and the ending is the same.
Phone vendors engineered QR integrations for maximum speed, leaving a massive security gap. Mobile OS parsers need to stop treating physical inputs as trusted triggers. Every scan requires pre-execution payload inspection—unrolling short links, analyzing domain structures, validating SSL certificates, and surfacing raw parameters—so users actually know what their phone is about to do before it does it.
Source: L’Auto-Journal, via cyberveille.ch. Related: The Visual Lie — how combosquatting and homograph domains beat the mobile preview.