Glossary
Quishing
Quishing is phishing delivered by QR code. It works because the destination is unreadable to a human before scanning, and because a code in an email image evades URL-based filtering that would catch the same link as text.
Why it is effective
- Nobody can read a URL from a pattern of squares. Every other phishing channel gives the target something to inspect.
- It moves the victim to a phone, which is usually outside corporate protection — no endpoint agent, no proxy, a truncated address bar.
- Email filters scan text, not images. A QR code in an attachment or an inline image frequently passes filters that would have blocked the link.
The common physical form
A sticker placed over a legitimate code — on a parking meter, a restaurant table, a charging point, a payment standee. The attack requires no technical skill at all.
Defences that work
- Check the URL on the preview screen before opening. Both iOS and Android show it.
- Look at the code physically. A sticker over a printed code has an edge you can feel.
- Never scan a code that arrives in an unexpected email, especially one claiming to be MFA re-enrolment.
- Treat "scan to receive money" as a scam, always. Payment codes initiate payments from the scanner.
- For businesses: print the payee name large, and check your standees daily.
Related
- Dynamic QR code — A dynamic QR code contains a short URL that redirects through a provider's server. That makes the destination editable and the scans trackable — and makes…
- Static QR code — A static QR code contains its destination directly in the pattern. It cannot be edited or tracked, and it never expires — because nothing has to keep…
- Short URL — A short URL is a brief address that redirects to a longer one. In QR codes it is used to reduce payload length — which genuinely produces a coarser, more…