Smishing vs quishing: one’s a scam text, the other’s a fake QR code. With smishing, the bad link turns up in a message on your phone. With quishing it’s tucked inside a code you scan, and that code could be almost anywhere. An email, a letter, a parcel, a sticker slapped on a parking meter.
Either way you end up on your phone, usually being asked for a card number or a password. Where they really differ is in how they get to you. A scam text needs your number first. A sticker on a meter just needs you to park there.
| Smishing | Quishing | |
|---|---|---|
| How it reaches you | A text or messaging-app message | A QR code: printed, emailed, in a PDF or a parcel |
| Needs your phone number? | Yes | No |
| What you see before opening | Often a shortened link | Nothing until you scan |
| The usual story | An unpaid toll, a parcel fee, a bank alert | Pay for parking, set up MFA, find out who sent a gift |
| A case from this library | Toll-road texts (2024 to 2025): more than 2,000 FBI complaints in about five weeks | UK council car parks (2024 to 2026): fake codes on parking machines |
| What stops it | Don’t tap. Open the app or type the address | Check the link preview, pay through the official app |
Key takeaways
Smishing is a numbers game. Take the toll texts. By April 2024 the FBI’s Internet Crime Complaint Center had more than 2,000 complaints about them, all from roughly the previous five weeks. Each text claimed you owed a few dollars in tolls, threatened a late fee if you didn’t pay, and pointed to a payment page made up to look like your state’s toll service. Full case: toll-road smishing wave.
Parcel texts work the same way. Researchers at Censys mapped one USPS and UPS operation and found 682 look-alike hostnames, with card details streamed to the operators as victims typed. Full case: USPS and UPS smishing kit.
Quishing doesn’t need a list of numbers. In the UK, fraudsters stuck fake codes on council parking machines and signs, sometimes over genuine PayByPhone codes. People scanned, landed on cloned payment sites and handed over card details. Full case: UK council car park QR scams.
In Orlando in June 2025, parking enforcement pulled about 200 counterfeit stickers off downtown meters, placed over the real ParkMobile decals. And in 2025 US agencies warned about unsolicited parcels carrying a QR code that promised to reveal who’d sent the gift. Full cases: Orlando meters and brushing parcels.
Tip: here’s a quick test. Did you go looking for this payment page, or did it come looking for you? If it came to you, by text or by code, close it and open the official app or site yourself.
Both scams finish on a phone screen, where the full address is hard to read and the page looks just like the real one. Both lean on small, everyday payments that don’t feel worth checking. And both sit mostly outside the email filters a company relies on.
They can also be combined. A text might tell you to scan a code, or a QR code might open a messaging chat. Either way, the defense doesn’t change.
Yes. Both are phishing delivered a different way: smishing by text, quishing by QR code. See smishing vs phishing and quishing vs phishing for how each compares with email.
In this library, smishing: 13 cases against 7. Texts are cheap to send in bulk, which is why the toll and parcel waves got so big. Quishing is newer and partly physical, so it’s harder to count.
Look for a sticker on top of another sticker, or a code on a machine that didn’t have one before. But the safest move is not to rely on spotting it at all. Pay through the operator’s app or website.
Don’t tap or scan. In the US, forward scam texts to 7726 (SPAM) and report losses at ic3.gov. For a suspicious code in a car park, tell the operator or council. If you’ve already entered card details, call your bank on the number on your card.
Browse the smishing cases and the quishing cases.
Reviewed by SEE Team. Last reviewed 21 Oct 2026. Each case link goes to the full write-up, sources included. How pages are researched and fact-checked. About Social Engineering Examples.
Social Engineering Examples