{"id":"https://openalex.org/W7202028396","doi":"https://doi.org/10.3390/jcp6040134","title":"Quishing: A Sociotechnical Framework for Understanding QR-Code Phishing Risks and User-Centered Protection Strategies","display_name":"Quishing: A Sociotechnical Framework for Understanding QR-Code Phishing Risks and User-Centered Protection Strategies","publication_year":2026,"publication_date":"2026-08-08","ids":{"openalex":"https://openalex.org/W7202028396","doi":"https://doi.org/10.3390/jcp6040134"},"language":"en","primary_location":{"id":"doi:10.3390/jcp6040134","doi":"https://doi.org/10.3390/jcp6040134","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp6040134","pdf_url":null,"source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","norway-1","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.3390/jcp6040134","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5016640864","display_name":"P. D. Filio-Aguilar","orcid":"https://orcid.org/0000-0002-7616-9764","observed_orcids":["https://orcid.org/0000-0002-7616-9764"]},"institutions":[{"id":"https://openalex.org/I4210166843","display_name":"Universidad del Ej\u00e9rcito y Fuerza A\u00e9rea","ror":"https://ror.org/04vbnwv73","country_code":"MX","type":"education","lineage":["https://openalex.org/I4210166843"]}],"countries":["MX"],"is_corresponding":true,"raw_author_name":"Pedro-David Filio-Aguilar","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5026125634","display_name":"Rub\u00e9n Mil\u2010Mart\u00ednez","orcid":"https://orcid.org/0000-0002-6713-464X","observed_orcids":["https://orcid.org/0000-0002-6713-464X"]},"institutions":[{"id":"https://openalex.org/I4210166843","display_name":"Universidad del Ej\u00e9rcito y Fuerza A\u00e9rea","ror":"https://ror.org/04vbnwv73","country_code":"MX","type":"education","lineage":["https://openalex.org/I4210166843"]}],"countries":["MX"],"is_corresponding":false,"raw_author_name":"Rub\u00e9n Mil-Mart\u00ednez","raw_affiliation_strings":[],"raw_orcid":"https://orcid.org/0000-0002-6713-464X","affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5139649008","display_name":"Lourdes L\u00f3pez-Garc\u00eda","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4210090124","display_name":"Tecnol\u00f3gico Nacional de M\u00e9xico","ror":"https://ror.org/00davry38","country_code":"MX","type":"government","lineage":["https://openalex.org/I1302736544","https://openalex.org/I4210090124","https://openalex.org/I4405258672"]}],"countries":["MX"],"is_corresponding":false,"raw_author_name":"Lourdes L\u00f3pez-Garc\u00eda","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5016640864"],"corresponding_institution_ids":["https://openalex.org/I4210166843"],"apc_list":{"value":1000,"currency":"CHF","value_usd":1207},"apc_paid":{"value":1000,"currency":"CHF","value_usd":1207},"fwci":7.2507,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":{"value":0.95717412,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":95,"max":96},"biblio":{"volume":"6","issue":"4","first_page":"134","last_page":"134"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.986299991607666,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.986299991607666,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11800","display_name":"User Authentication and Security Systems","score":0.00570000009611249,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.003800000064074993,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/qr-codes","display_name":"QR codes","score":0.7730000019073486},{"id":"https://openalex.org/keywords/phishing","display_name":"phishing","score":0.7120000123977661},{"id":"https://openalex.org/keywords/socio-technical-framework","display_name":"socio-technical framework","score":0.8140000104904175},{"id":"https://openalex.org/keywords/user-security-behavior","display_name":"user security behavior","score":0.7730000019073486},{"id":"https://openalex.org/keywords/qr-code-verification","display_name":"QR code verification","score":0.718999981880188},{"id":"https://openalex.org/keywords/destination-visibility","display_name":"destination visibility","score":0.9129999876022339},{"id":"https://openalex.org/keywords/phishing-mitigation","display_name":"phishing mitigation","score":0.492000013589859}],"concepts":[{"id":"https://openalex.org/C127627568","wikidata":"https://www.wikidata.org/wiki/Q1639361","display_name":"Sociotechnical system","level":2,"score":0.9717000126838684},{"id":"https://openalex.org/C2779530757","wikidata":"https://www.wikidata.org/wiki/Q1207505","display_name":"Quality (philosophy)","level":2,"score":0.5619999766349792},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.5612999796867371},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5349000096321106},{"id":"https://openalex.org/C173801870","wikidata":"https://www.wikidata.org/wiki/Q201413","display_name":"Heuristic","level":2,"score":0.4772000014781952},{"id":"https://openalex.org/C83860907","wikidata":"https://www.wikidata.org/wiki/Q135005","display_name":"Phishing","level":3,"score":0.4657999873161316},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.3878999948501587},{"id":"https://openalex.org/C199033989","wikidata":"https://www.wikidata.org/wiki/Q1318295","display_name":"Narrative","level":2,"score":0.37119999527931213},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.3596999943256378},{"id":"https://openalex.org/C539667460","wikidata":"https://www.wikidata.org/wiki/Q2414942","display_name":"Management science","level":1,"score":0.32690000534057617},{"id":"https://openalex.org/C2780033181","wikidata":"https://www.wikidata.org/wiki/Q24962805","display_name":"Decision aids","level":3,"score":0.30390000343322754},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.302700012922287},{"id":"https://openalex.org/C14224292","wikidata":"https://www.wikidata.org/wiki/Q13600188","display_name":"Conceptual framework","level":2,"score":0.29809999465942383},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.29649999737739563},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.29420000314712524},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.29269999265670776},{"id":"https://openalex.org/C182449105","wikidata":"https://www.wikidata.org/wiki/Q3099732","display_name":"Technical report","level":2,"score":0.27799999713897705},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.25780001282691956},{"id":"https://openalex.org/C184356942","wikidata":"https://www.wikidata.org/wiki/Q830382","display_name":"Best practice","level":2,"score":0.2508000135421753}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.3390/jcp6040134","doi":"https://doi.org/10.3390/jcp6040134","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp6040134","pdf_url":null,"source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","norway-1","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},{"id":"doi:10.20944/preprints202606.2048.v1","doi":"https://doi.org/10.20944/preprints202606.2048.v1","is_oa":true,"landing_page_url":"https://doi.org/10.20944/preprints202606.2048.v1","pdf_url":null,"source":{"id":"https://openalex.org/S6309402219","display_name":"Preprints.org","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"posted-content"},{"id":"pmh:oai:doaj.org/article:5b3d6095850b45348c4b3d151d8e9c2e","doi":null,"is_oa":false,"landing_page_url":"https://doaj.org/article/5b3d6095850b45348c4b3d151d8e9c2e","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Journal of Cybersecurity and Privacy, Vol 6, Iss 4, p 134 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3390/jcp6040134","doi":"https://doi.org/10.3390/jcp6040134","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp6040134","pdf_url":null,"source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","norway-1","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[{"display_name":"Systematic Review","id":"https://openalex.org/study-designs/systematic-review"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":39,"referenced_works":["https://openalex.org/W1582830784","https://openalex.org/W2063519841","https://openalex.org/W2071869991","https://openalex.org/W2131906261","https://openalex.org/W2142287040","https://openalex.org/W2152060369","https://openalex.org/W2252446659","https://openalex.org/W2335888457","https://openalex.org/W2347140731","https://openalex.org/W2619600699","https://openalex.org/W2891378911","https://openalex.org/W2933127114","https://openalex.org/W2974038423","https://openalex.org/W3089127450","https://openalex.org/W3123497531","https://openalex.org/W3208879170","https://openalex.org/W4213337375","https://openalex.org/W4221006488","https://openalex.org/W4224273437","https://openalex.org/W4297659151","https://openalex.org/W4323275531","https://openalex.org/W4379161776","https://openalex.org/W4395469144","https://openalex.org/W4401296832","https://openalex.org/W4402460632","https://openalex.org/W4403626068","https://openalex.org/W4407278770","https://openalex.org/W4409385495","https://openalex.org/W4410768670","https://openalex.org/W4413966888","https://openalex.org/W4414041257","https://openalex.org/W4415248111","https://openalex.org/W4417252139","https://openalex.org/W7118075766","https://openalex.org/W7153534111","https://openalex.org/W7160039816","https://openalex.org/W7163896351","https://openalex.org/W7167218944","https://openalex.org/W7168136202"],"related_works":["https://openalex.org/W4409404287","https://openalex.org/W7153877877","https://openalex.org/W6912006491","https://openalex.org/W4392720799","https://openalex.org/W4416850808","https://openalex.org/W4396833451","https://openalex.org/W4409430968","https://openalex.org/W4415248111","https://openalex.org/W6910623411","https://openalex.org/W4306941741"],"abstract_inverted_index":{"The":[0,71,93,115],"widespread":[1],"use":[2],"of":[3,101,123,138],"Quick":[4],"Response":[5],"(QR)":[6],"codes":[7],"increases":[8],"exposure":[9],"to":[10],"QR-code-based":[11],"phishing,":[12],"or":[13,79,85,90,136],"quishing.":[14],"This":[15],"study":[16],"examines":[17],"the":[18,121],"mechanisms,":[19],"user":[20,151],"behaviors,":[21],"and":[22,37,51,87,110,131,158,166,182,189,195],"contextual":[23,124],"conditions":[24],"that":[25,118],"shape":[26],"QR-mediated":[27],"risk":[28],"from":[29,58],"a":[30,147,150,155],"sociotechnical":[31,148],"perspective.":[32],"A":[33],"structured":[34],"literature":[35],"review":[36],"narrative":[38],"synthesis":[39,116],"were":[40,56,105],"conducted":[41],"using":[42,68],"four":[43,88],"documented":[44],"search":[45],"strings.":[46],"Following":[47],"deduplication,":[48],"screening,":[49],"retrieval,":[50],"full-text":[52],"assessment,":[53],"27":[54],"studies":[55,104],"included":[57],"71":[59],"identified":[60],"records.":[61],"Two":[62],"reviewers":[63],"independently":[64],"evaluated":[65],"methodological":[66],"quality":[67,96,109],"six":[69],"criteria.":[70],"corpus":[72],"comprised":[73],"16":[74],"technical-detection":[75],"studies,":[76,81],"five":[77],"user-centered":[78],"behavioral":[80,181],"two":[82],"attack":[83,145],"demonstrations":[84],"simulations,":[86],"reviews":[89],"preventive":[91],"frameworks.":[92],"mean":[94],"consensus":[95],"score":[97],"was":[98],"10.04":[99],"out":[100],"12;":[102],"19":[103],"classified":[106],"as":[107,112],"high":[108],"eight":[111],"moderate":[113],"quality.":[114],"indicates":[117],"quishing":[119],"exploits":[120],"interaction":[122],"legitimacy,":[125],"routine":[126],"scanning,":[127],"limited":[128],"destination":[129],"visibility,":[130],"insufficient":[132],"verification":[133,177],"before":[134],"navigation":[135],"disclosure":[137],"sensitive":[139],"information.":[140],"These":[141,161],"findings":[142],"informed":[143],"an":[144],"lifecycle,":[146],"model,":[149],"security":[152],"decision":[153],"flow,":[154],"risk\u2013protection":[156],"mapping,":[157],"multilevel":[159],"recommendations.":[160],"literature-derived":[162],"artifacts":[163],"are":[164],"conceptual":[165],"heuristic":[167],"rather":[168],"than":[169],"empirically":[170],"validated.":[171],"Effective":[172],"mitigation":[173],"therefore":[174],"requires":[175],"QR-specific":[176],"mechanisms":[178],"combined":[179],"with":[180],"technical":[183],"safeguards":[184],"for":[185],"users,":[186],"interfaces,":[187],"organizations,":[188],"platforms,":[190],"followed":[191],"by":[192],"expert,":[193],"usability,":[194],"experimental":[196],"validation.":[197]},"counts_by_year":[{"year":2026,"cited_by_count":2}],"updated_date":"2026-11-12T12:28:57.059296","created_date":"2026-08-10T00:00:00"}