StackShield: Stacked Character-Level and Explainable URL Features for Phishing Detection in QR/NFC Systems

Abstract QR codes and NFC tags hide their destination URL until the user scans or taps, so phishing (quishing) must be detected from the URL alone, before any page loads. We show that the 97–99% accuracy reported for URL detectors does not hold under these scan-time conditions. On the UCI Phishing Websites dataset, accuracy falls from 97.2% to 73.7% when only URL-string features are used. In PhiUSIIL, every legitimate URL is an https://www. homepage, so a one-line rule reaches 99.1% accuracy; the same rule exceeds 99.6% on two further benchmarks, and a PhiUSIIL-trained model performs at chance level on four other datasets. We propose StackShield, a scan-time detector that stacks the out-of-fold score of a character n-gram model with 116 explainable lexical, structural, hosting and brand-impersonation features in an XGBoost classifier. On 166,542 PhreshPhish URLs collected after the training period, StackShield raises balanced accuracy from 89.1% to 96.8% (AUC 99.5%) and detects 94.4% of phishing at a 1% false-positive rate, versus 71.9% for the baseline. Detection of lookalike https://www. phishing rises from 66% to 85%, and of brand impersonation from 71% to 97%. A heterogeneous stacking ensemble adds no practical gain at 35 times the training cost. StackShield classifies a URL in 25 ms and explains its decisions with SHAP.