Quishing: The Hidden Threat in Every Black-and-White Square of a QR Code — And Why Beauty Is the Best Defence

What Is Quishing?

"Quishing" is the portmanteau of QR and phishing — and it's one of the fastest-growing cybercrime techniques of our time. In a quishing attack, a criminal replaces a legitimate QR code (or creates a fake one) that directs scanners not to a real website, but to a fraudulent page designed to steal credentials, financial data, or install malware on a device.

What makes quishing uniquely dangerous is that a QR code gives no visual clue about its destination. Every standard QR code looks essentially the same: a grid of black squares on a white background. A malicious code is visually indistinguishable from a legitimate one. Criminals simply print a sticker, paste it over the original, and walk away.

The Numbers Are Alarming

This is no niche problem. Quishing has grown from an obscure attack vector into one of the dominant threats in the cybercrime landscape:

QR code phishing now accounts for 12% of all phishing attacks, up from just 0.8% in 2021. Security researchers note that these attacks are especially effective in physical, public-facing contexts — precisely the environments where memorial plaques, cemetery signage, and heritage trail panels live.

Why Public & Memorial Spaces Are Particularly at Risk

Quishing thrives wherever people are primed to scan without questioning. Museums, tourist trails, heritage sites, and cemeteries share several characteristics that make them attractive targets:

Why Our Artistic QR Codes Are Fundamentally Different

At Forever Connected, we made a deliberate choice from the beginning: our QR codes are not generic black-and-white grids. They are handcrafted visual artworks — each one a unique composition of imagery, colour, and texture woven around a scannable code. That artistic choice turns out to be one of the most powerful anti-quishing measures possible.

Here is why — across five distinct dimensions of protection:

Protection 01 — Visual Complexity That Is Nearly Impossible to Replicate

A standard QR code sticker costs pennies to print. An attacker can generate a matching replacement in minutes. But our designs are composite artworks combining specific botanical or natural imagery, precise colour palettes, controlled lighting conditions, and QR matrix integration across hundreds of visual layers. Reproducing one convincingly would require access to our proprietary generation pipeline, the original prompt parameters, and our model fine-tuning — a barrier that is orders of magnitude higher than printing a sticker.

Protection 02 — A Visual Landmark That People Learn to Recognise

In a cemetery where Forever Connected plaques are installed, or on a heritage trail fitted with our information panels, visitors develop visual familiarity over time. The dandelion. The poppy field at sunset. The birch forest in morning mist. These are not interchangeable. They are landmarks — as recognisable as a shop sign or a brand logo.

A family that visits a grave regularly will notice immediately if the warm artwork they know has been replaced by a plain black-and-white sticker. A regular visitor to a museum trail spots the inconsistency. That ambient recognition is a passive, always-on detection layer that no software can replicate.

Protection 03 — Each Artwork Is a Personal Fingerprint

Every Forever Connected plaque carries a unique generated composition — not a shared template, but a specific arrangement of light, texture, botanical detail, and colour that belongs to that one memorial and no other. The dandelion on your mother's plaque is not the same as the dandelion on a neighbour's. 

A family that visits regularly develops an intimate familiarity with their artwork. That is a fundamentally different relationship than recognising a logo. A criminal who wanted to fake a specific plaque would need to reproduce not a publicly available brand element, but a precise, one-of-a-kind image they have never been given access to generate. The personalisation is the protection.

Protection 04 — Tampering Is Immediately Visible

Because our QR codes are embedded within the artwork — not printed on top of it — any overlay sticker will visually interrupt the composition. The stems no longer flow naturally. The petals don't align. The background colours clash. There is no clean seam. Whereas a white sticker with a fake QR code on a white background is nearly invisible, a covering placed over an intricate botanical illustration announces itself.

Protection 05 — One Glance at the URL Is All It Takes

Modern smartphones show a destination URL preview in the camera viewfinder before the browser opens — a one-second habit that costs nothing and stops a quishing attack in its tracks. Every legitimate Forever Connected code resolves to a foreverconnected.store address. That domain is short, specific, and memorable.

If the preview shows anything else — an unfamiliar domain, a URL shortener, a string of random characters — the scan should be abandoned immediately. We actively educate families and institutional partners (cemetery managers, heritage trail coordinators) to make this a reflex. Combined with the physical tamper-visibility of our engraved plaques, it creates a simple two-step check: does the artwork look right, and does the URL read right? Both questions can be answered before a single tap.

What You Can Do as a Family or Cemetery Manager

Even with our protections in place, a few simple habits add an extra layer of confidence:

A Closing Thought

We often hear that our artistic QR codes are beautiful. We're proud of that. But beauty in this context is not decoration — it is function. It is the element that makes a fake immediately obvious, that builds recognition across visits, that turns a passive object into an active trust signal.

In a world where cybercriminals are increasingly moving from digital inboxes into physical public spaces, the visual distinctiveness of our designs is one of the most meaningful protections we can offer to families, cemeteries, and heritage sites. The art is the authentication.