The Risk of Political Quishing
Abstract
This study examines the risk of QR code phishing — which we will be referring to as quishing from this point forward — in the context of political elections in Romania. Through a field experiment, we deployed posters featuring both political and social content, each framed in either a neutral or clickbait style, to evaluate how different social engineering techniques influence interaction outcomes. Our results indicate that politically framed clickbait posters generated substantially higher scan rates, while conversion patterns varied across conditions. These findings highlight the viability of QR codes as a powerful attack vector in politically charged environments, and the need for awareness campaigns, as subjects were not only interested in scanning them, but also in submitting their email addresses.
References
[2] Antino Kim and Alan R Dennis. Says who? the effects of presentation format and source rating on fake news in social media. Mis quarterly, 43(3):1025–1040, 2019.
[3] Filipo Sharevski, Amy Devine, Emma Pieroni, and Peter Jachim. Phishing with malicious qr codes. In Proceedings of the 2022 European Symposium on Usable Security, pages 160–171, 2022.
[4] Timothy Vidas, Emmanuel Owusu, Shuai Wang, Cheng Zeng, Lorrie Faith Cranor, and Nicolas Christin. Qrishing: The susceptibility of smartphone users to qr code phishing attacks. In International conference on financial cryptography and data security, pages 52–69. Springer, 2013.
[5] Dongwan Shin and Huiping Yao. A user study of security warnings for detecting qr code based attacks on android phone. J. Wirel. Mob. Networks Ubiquitous Comput. Dependable Appl., 4(4):49–64, 2013.
[6] Mihai VACARIU. Alegerile prezidentiale din romania 2024: dezinformare si manipulare ın campania lui georgescu. ELITELE POLITICE LA ROTATIVA ISTORIEI. ALEGERILE DIN 2024, page 115, 2024.
[7] Premier Ministre-SGDSN. Manipularea algoritmilor si instrumentalizarea influencerilor. concluzii desprinse din alegerile prezidentiale din romania & riscuri pentru franta, 2025.
[8] Pavlo Burda, Luca Allodi, and Nicola Zannone. Cognition in social engineering empirical research: a systematic literature review. ACM Transactions on Computer-Human Interaction, 31(2):1–55, 2024.
[9] Leonardo Ballesteros-L´opez, Carlos Mej´ıa-Vayas, Sonia Armas-Arias, and Carla-S Castro-Altamirano. Qr codes as a strategy in political marketing 2.0. In International Conference on Computer Science, Electronics and Industrial Engineering (CSEI), pages 3–13. Springer, 2022.
[10] F Ley Sylvester. Mobile device users’ susceptibility to phishing attacks. arXiv preprint arXiv:2203.01823, 2022.
[11] Liliana Ribeiro, Inˆes Sousa Guedes, and Carla Sofia Cardoso. Which factors predict susceptibility to phishing? an empirical study. Computers & Security, 136:103558, 2024.
[12] Aya Muhanad, Israa Abuelezz, Khaled Khan, and Raian Ali. On how cialdini’s persuasion principles influence individuals in the context of social engineering: a qualitative study. In International Conference on Web Information Systems Engineering, pages 373–388. Springer, 2024.
[13] Marvin Geisler and Daniela P¨ohn. Hooked: A real-world study on qr code phishing. arXiv preprint arXiv:2407.16230, 2024.
[14] Jeremiah D Still, Thomas Morris, and Morgan Edwards. Investigating university qr code interactions. In International Conference on Human-Computer Interaction, pages 204–214. Springer, 2024.
[15] Jonas Nygaard Blom and Kenneth Reinecke Hansen. Click bait: Forward-reference as lure in online news headlines. Journal of pragmatics, 76:87–100, 2015.
[16] Jieun Shin, Chris DeFelice, and Soojong Kim. Emotion sells: Rage bait vs. information bait in clickbait news headlines on social media. Digital Journalism, pages 1–20, 2025.
[17] Mihai Vacariu. Manipulation and disinformation in the 2024 romanian presidential elfections. Redefining Community in Intercultural Context, 12(1):81–88, 2025.
[18] Esther Niehoff and Suzanne Oosterwijk. To know, to feel, to share? exploring the motives that drive curiosity for negative content. Current Opinion in Behavioral Sciences, 35:56–61, 2020.
This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.
Transfer of copyright agreement: When the article is accepted for publication, I, as the author and the representative of the coauthors, hereby agree to transfer to Studia Universitatis Babes-Bolyai, Series Informatica, all rights, including those pertaining to electronic forms and transmissions, under existing copyright laws, except for the following, which the authors specifically retain: the authors can use the material however they want as long as it fits the NC ND terms of the license. The authors have all rights for reuse according to the below license.
