Smishing delivers a malicious link by text message. Quishing hides the link inside a QR code, which can be printed and placed on physical objects, so quishing can reach someone who received no message at all.
Smishing still needs a delivery list and a route to the handset. Quishing does not necessarily need either: a sticker on a parking meter reaches whoever walks up to it.
Both land on a personal phone, which is the shared point. That device usually sits outside corporate filtering and outside the endpoint controls protecting a work laptop, which is exactly why both channels are growing.
Social Engineering Examples