The short answer
Quishing is phishing that uses a QR code instead of a clickable link. The victim scans the code with a phone and lands on a fake login, payment or download page. It works because some email filters do not read links inside images, and phones often sit outside workplace security controls.
On this page
Quishing is phishing that hides a malicious link inside a QR code. Instead of clicking a link, the victim scans the code with a phone and is taken to a fake login, payment or download page. The name joins “QR” and “phishing”, and it is one of several types of phishing attack in our cyber security glossary.
What is quishing and how do QR code scams work?
A QR code usually holds a web address in a form people cannot read. That is the attacker’s advantage: you cannot check where a code leads until you scan it, and once the phone opens the page, the attack works like any other phishing site.
A typical QR code scam runs in four steps:
- The attacker places a code where people expect one: an email, a PDF, a letter, a poster or a sticker on a payment machine.
- A pretext tells the target to scan it now: a payment is due, an account is locked or a document is waiting.
- The code opens a look-alike page, often behind redirects that make the real destination harder to inspect.
- The page asks for a password, MFA code, card details or an app install.
What are the most common quishing attacks and lures?
| Lure | Where it appears | What the attacker wants |
|---|---|---|
| Parking and charging payments | Stickers placed over genuine codes on machines and signs | Card details |
| MFA reset or “re-authenticate your account” | Emails styled as Microsoft 365 or IT notices | Work login and MFA code |
| Unpaid invoice or shared document | Email body or PDF attachment | Login to a fake document portal |
| Payroll, pension or benefits update | Emails that appear to come from HR | Personal and bank details |
| Parcel redelivery | Printed cards or emails | Card details for a small “fee” |
For a business, the MFA reset lure carries the highest stakes, because a work account usually opens email, files and sometimes payment systems.
Why do email filters miss QR codes?
Because the link is drawn as a picture rather than written as text, some email security tools never see it. The NCSC’s blog QR codes: what’s the real risk? gives three reasons criminals use them in phishing emails: people are wary of suspicious and shortened links, not all phishing detection tools scan images, and people scan with personal phones that may lack the protection of a work computer.
Attackers add other evasion techniques:
- Codes placed inside PDF or Word attachments rather than the email body.
- Codes built from text characters or HTML tables instead of an image, so image scanning finds nothing.
- Redirect chains and CAPTCHA pages that stop automated scanners reaching the final page.
- The move to a phone, where web filtering, endpoint protection and full address previews are often missing.
Ask your email security provider whether it decodes QR codes in images and attachments, and treat any phone that scans a work email as part of your attack surface.
How do you spot a malicious QR code?
Treat a QR code as a link from an unknown sender and check the context before the content:
- Was it expected? Be wary of any email asking you to scan a code to log in, reset MFA or view a document. IT teams rarely work this way.
- Check the preview. Most phone cameras show the web address before opening it. Look for misspellings, odd domains and shortened links.
- Look for stickers. On parking machines and signs, check whether a code has been stuck over the original, and pay through the operator’s official app or website instead.
- Never sign in after scanning. If a page asks for your work password, close it and go to the service directly.
- Report it. Use your phishing report button, or report the scam email to the NCSC.
Our guide on how to spot a phishing email covers the wider warning signs staff should know.
How can a business stop quishing attacks?
No single control stops quishing, so combine email, sign-in and device measures with a clear rule for staff:
| Control | What it does against quishing |
|---|---|
| QR decoding in email security | Reads codes in images, PDFs and Office attachments so the hidden link can be checked like any other. Ask your provider whether it does this and whether the feature needs turning on |
| Phishing-resistant sign-in | Passkeys and FIDO2 security keys only work on the genuine website, so a password and code typed into a fake page cannot be replayed |
| Sign-in only from managed devices | Conditional access rules that admit only managed or compliant devices limit what a stolen work password can do |
| Phones treated as work devices | Phones that read work email are kept updated, protected and, for Cyber Essentials, counted in your certification scope |
| A house rule on QR codes | Staff are told the organisation will never ask them to scan a code to sign in, reset MFA or approve a payment, so any message that does stands out |
| Checks on your own printed codes | Codes you put on car parks, signs or payment points are inspected for stickers and printed with the full web address beside them |
Fast reporting ties these together. A one-click report button, and thanks rather than blame for reporting after a scan, gets a suspicious code to the security team while it can still be blocked for everyone else.
How can phishing simulations include QR code scenarios?
A phishing simulation can send a realistic QR email, such as an MFA reset notice or a shared invoice, that leads to a safe, tracked landing page. The results show how many people scanned the code, how many went on to enter details and, most usefully, how many reported it. Because scans happen on phones, a QR scenario also tests whether staff carry their caution from the desk to the mobile.
QR scenarios can be included in our phishing simulation and social engineering testing campaigns, agreed with you in advance and reported by team, not by name.
How can Sovereign Secure help?
Sovereign Secure is a PCI SSC Qualified Security Assessor company and ISO 27001 certified, and our penetration testing covers social engineering alongside web, network, cloud and mobile testing. To add QR code scenarios to a phishing campaign, request a penetration testing quote or contact our team.
Your next step
- Phishing simulationRealistic email, QR code and vishing campaigns, reported by team rather than by name.See phishing simulation
- Social engineeringPhishing, phone and on-site pretext tests that show how your staff respond.See how we test
- Scope your testChoose your channels online to scope a phishing or social engineering test.Scope your test
Last reviewed October 2026 by the Sovereign Secure assessment team.
