The Spanish National Police are currently warning of an increase in cyber fraud cases in the Balearic Islands, known as "QRishing." In this insidious form of phishing, criminals use manipulated QR codes to steal sensitive data from tourists and residents.
The fraudsters cover legitimate codes on restaurant menus, parking meters, or even fake parking tickets with deceptively realistic stickers. As soon as a user scans the code with their smartphone, they are redirected to a manipulated website that is visually almost indistinguishable from the original but serves solely to steal credit card data and identities.
The technique behind this scam exploits users' psychological habituation to digital interfaces. Since the pandemic, the use of QR codes in public spaces has increased dramatically, leading to decreased vigilance. Additional reports from Spanish security authorities indicate that the perpetrators are increasingly operating in high-traffic areas such as Palma Airport and the tourist centers of Playa de Palma and Calvià. In some cases, the scan not only leads to a phishing site but also triggers the background download of malware that can compromise banking apps directly on the mobile device.
Cybersecurity experts strongly advise physically inspecting QR codes before use. A code that has been covered with a sticker or appears uneven is a clear warning sign. Before entering payment details, the URL in your smartphone's browser must be checked for inconsistencies in the domain spelling. Police point out that official bodies in Spain never process sensitive transactions or fine payments solely via a spontaneous QR code scan without additional authentication. Anyone who has already entered data should contact their bank immediately and have the affected cards blocked.
In addition to financial losses, victims often face long-term identity theft. The collected data is resold within criminal networks, which can lead to unauthorized account openings or purchases in the victims' names. Because the perpetrators often operate internationally and quickly remove the manipulated codes, prosecution is difficult. Nevertheless, law enforcement agencies urge those affected to report every incident in order to create movement profiles of the perpetrator groups and to provide the public with targeted information about the latest locations of manipulated codes.