Security & privacy
Quishing: QR code phishing explained
Quishing is phishing delivered by QR code. It works for two structural reasons: a human cannot read a URL from a pattern before scanning it, and email filters that inspect text do not inspect codes inside images and attachments.
Why it works
1. The destination is unreadable before you act. Every other phishing channel shows the victim something they can inspect. A QR code shows a pattern.
2. It moves the victim to a personal device. Phones are usually outside corporate protection — no endpoint agent, no proxy, no URL rewriting — and the mobile browser truncates the address bar, hiding the part of the domain that matters.
3. Email security scans text, not pixels. A QR code embedded in an image or a PDF attachment routinely passes filters that would have blocked the same URL written out.
The common campaigns
| Lure | Typical target |
|---|---|
| "Re-enrol your MFA" with a code in a PDF | Corporate credentials |
| "Your parcel could not be delivered" | Card details |
| Sticker on a parking meter | Payment card details |
| Sticker on a restaurant payment standee | Diverted payment |
| Sticker on an EV charger | Payment card details |
| "Review your payslip" | Payroll redirection |
The physical sticker attacks require no technical skill at all, which is why they are so common.
Defences for individuals
- Read the preview banner before opening. Check the domain immediately before the first single slash.
- Never scan a code from an unexpected email, especially about MFA, payroll or deliveries.
- Feel for a sticker edge on public payment codes.
- Check the payee name in your payment app against the printed business name.
- Navigate manually for anything involving credentials or money. Type the address you know.
Defences for organisations
- Include QR codes in phishing-awareness training. Most programmes still only cover links and attachments.
- Inspect images and attachments for codes at the mail gateway — several security products now decode them.
- Publish your real domains. If customers know you only ever use
pay.example.com, a fraudulent sticker is easier to spot. - Inspect physical codes on a schedule. Payment standees, parking machines and public signage should be checked as part of a routine.
- Print the payee name large next to payment codes, so a substitution is visible on the confirmation screen.
- Do not train customers to trust shorteners. If your own material uses
bit.ly, you have taught them that hidden destinations are normal.
FAQ
What is quishing?
Phishing delivered by QR code. The victim scans a code that leads to a credential-harvesting or payment page, instead of clicking a link.
Why do email filters miss QR code phishing?
Traditional filters inspect text and URLs. A code inside an image or PDF attachment carries no text to inspect, so the message passes.
How do I spot a malicious QR code sticker?
Feel the surface — a sticker applied over a printed code has a raised edge. On payment codes, check that the payee name shown in your app matches the business name printed on the sign.
What should organisations do about quishing?
Add QR codes to phishing training, decode codes in images at the mail gateway, publish the only domains you use, and physically inspect public payment codes on a routine.
Related
- Are QR codes safe? — Scanning a QR code is safe in itself — it decodes text and nothing else. The risk is entirely in what you do next. A code cannot install software, dial,…
- How to check where a QR code goes before opening it — Use the preview banner both iOS and Android show before opening, and read the domain immediately before the first single slash. To inspect without any…