Quishing (a blend of "QR" and "phishing") is a scam where a malicious link is hidden inside a QR code instead of being sent as plain text. When you scan the code, your phone's browser opens the hidden link — often before you have had any real chance to see where it leads.

It ends the same way traditional phishing does: a fake login page, a bogus payment form, or a page that quietly collects what you type. The difference is entirely in the delivery, and that difference is why it spread.

How a quishing attack works

A QR code is a visual encoding of text, usually a web address. Nothing in the code itself says whether that address is safe. Your phone reads the address and opens it, and it treats a bank's real login page and a copy of it exactly the same way.

The reason this defeats so many email defences is mechanical. Most email security scans text for suspicious links. A QR code is an image: the address is a pattern of dark and light squares, not characters, so a text-based scanner has nothing to match against its blocklists. Microsoft describes attackers "embedding malicious URLs within image-based QR codes" precisely to "exploit the limitations of text-based scanning engines."

There is a second deliberate effect. Scanning moves you from a managed work computer to your own phone, which is usually outside whatever filtering, logging and endpoint protection your employer runs. Kaspersky's analysts make the same point: codes in PDF attachments push people to scan "on mobile phones, which may have weaker security than work PCs."

The address itself is usually not the final destination. It typically runs through a redirect chain, often starting at a URL shortener, before landing on a cloned login page. So even someone careful enough to read the first link does not see the domain that eventually asks for their password.

Worth knowing

There is no visual tell. A QR code that looks perfectly ordinary can point anywhere, and two codes that look equally tidy can lead to a real bank and a fake one. The pattern cannot be judged by eye — only the link inside it can be checked.

How big the problem actually is

Two independent measurements give a sense of scale, and they agree on the direction.

Egress tracked QR codes as a share of the phishing attacks it observed. The tactic barely registered at first, then jumped sharply:

YearShare of observed phishing attacks using QR codes
20210.8%
20221.4%
202312.4%
2024 (to April)10.8%

So by 2023 roughly one phishing attack in eight carried a QR code, where two years earlier it had been fewer than one in a hundred. For the year-by-year story behind those numbers, see our quishing timeline.

Raw volumes have kept climbing since. Kaspersky's detections of phishing emails carrying malicious QR codes rose from 46,969 in August 2025 to 249,723 in November 2025, more than fivefold in four months. Microsoft's Q1 2026 email threat report then recorded 7.6 million such threats in January 2026 rising to 18.7 million in March, which it described as the highest monthly volume in at least a year.

Consumer habits explain why it pays off. In a NordVPN survey reported by CNBC in July 2025, 73% of Americans said they scan QR codes without checking where they lead, and NordVPN estimated more than 26 million people had already been sent to a malicious site this way. That is a survey estimate rather than a measured count, but the habit it describes is the one every quishing campaign depends on.

Where the code reaches you

The mental image of quishing is a sticker on a parking meter. The measured reality is mostly email attachments. Microsoft's breakdown of QR code attacks through the first quarter of 2026:

  • PDF attachments — the dominant method, growing from 65% of QR code attacks in January to 70% in March.
  • Word documents (DOC/DOCX) — rising in absolute volume every month, though their share fell from 31% to 24% as PDFs took over.
  • Codes placed directly in the email body — only about 5% of the total, but up 336% in March alone. No attachment is needed, which removes a step defenders often watch.

The practical lesson: an unexpected PDF that wants you to scan something deserves the same suspicion as an unexpected link, and more suspicion than a code on a poster, because the attacker chose you.

How attackers hide from scanners

As security tools started reading QR codes in email, attackers started breaking the codes so tools cannot read them. Barracuda's threat analysts documented two techniques in August 2025, both sold through phishing-as-a-service kits:

  • Split codes. The code is cut into two separate images placed next to each other in the email. A person sees one code and scans it normally. An automated scanner sees two unrelated, meaningless images. Barracuda linked this to the Gabagool kit, whose emails posed as Microsoft password reset requests.
  • Nested codes. A malicious code is embedded within or around a legitimate one. In the examples Barracuda found, the inner code pointed to Google while the outer code led somewhere harmful, so a scanner that reads the code may report a perfectly reputable destination. This one was linked to the Tycoon 2FA kit.

Neither trick changes what you should do. Both change what your employer's filter can promise you, which is the point of them.

The lures that work

Kaspersky's analysis of these campaigns found three recurring stories:

  • Login pages. Forms imitating Microsoft accounts or an internal company portal.
  • HR notices. Messages urging an employee to review or sign a document, such as a vacation schedule or a list of staff being let go. The subject matter makes people scan before thinking.
  • Invoices and purchase confirmations. Often in a PDF, and often paired with a phone call pressuring the recipient to act — a QR code and a voice on the line, reinforcing each other.

In the United States, tax season adds another. The IRS put QR codes on its 2026 "Dirty Dozen" list of tax scams, describing messages that use "alarming language and QR codes that direct taxpayers to fake IRS websites to 'verify' accounts."

Codes in the physical world

Physical quishing is a smaller share of the volume but it is where most people meet it first, and the pattern is consistent.

Parking meters and pay stations. A sticker appears over or beside the legitimate code, offering discounted parking or a new payment method, and the page asks for card details. The FTC warned about exactly this in September 2026, and its first piece of advice is to read the link before you open it.

Restaurant menus. A diner scans a table-tent code expecting a menu and lands on a page imitating the restaurant's ordering system, asking for name, email and card number before showing any food. The restaurant never sees any of it. More in our restaurant guide.

Delivery and package notices. Fake labels or door hangers claim a package is being held and needs a small fee, and the code leads to a page mimicking the carrier.

The FBI has warned about tampered codes on parking meters, cryptocurrency kiosks and restaurant payment terminals since January 2022, and its advice has not changed: check the address after scanning and before entering anything, and look at the code itself for a sticker placed over the original. Our guide to spotting a fake sticker covers the physical signs.

Why strong passwords and MFA may not save you

This is the part most people have not caught up with. In January 2026 the FBI issued a flash alert about the North Korean group Kimsuky running QR code spearphishing against think tanks, universities, NGOs, foreign policy experts and government entities. The lures were ordinary — a questionnaire, a secure document drive, registration for a conference that did not exist — sent from addresses spoofed to look like an embassy employee or a think tank colleague.

What matters is the end of the chain. Victims landed on mobile-optimised pages imitating Microsoft 365, Okta or a VPN portal. The FBI notes these campaigns "frequently end with session token theft and replay": the attacker captures the session your successful login creates and reuses it. That lets them in without a password prompt and without triggering the failed-MFA alerts a security team would normally see, because from the system's point of view nothing failed.

Approving a legitimate-looking push notification is therefore not proof you are safe. The FBI's recommendation for organisations is phishing-resistant MFA — passkeys or hardware security keys rather than codes and push approvals — plus verifying any QR code request through a second channel before entering credentials. If you handle staff security, our workplace guide goes further.

Five red flags before you scan

  1. Did it arrive as an attachment? A PDF or Word document whose only purpose is to make you scan a code is the single most common form this attack now takes. Legitimate services send clickable links.
  2. Does a sticker cover an existing code? A new code over or beside an old one is a serious warning sign. Businesses rarely layer codes.
  3. Does the message create urgency? "Pay now or be towed", "package expires today", "sign before end of day". Pressure exists to remove the pause.
  4. Did you ask for this? If you did not order anything, start a payment, or expect a document, an unexpected code telling you to act deserves suspicion.
  5. Can you verify another way? Look up the company's website or phone number yourself. Never use contact details printed on the suspicious material.

How to protect yourself

The core defence is simple: never let a QR code take you somewhere before you know where that is.

  • Use your phone's built-in preview — both iOS and Android show the destination address before opening it — as a first, quick check.
  • Read the whole domain, not the start of it. secure-login.example-bank.co is not example-bank.com.
  • Treat a code in an email or attachment as more suspicious than a code on a wall, not less.
  • Never enter a password or payment detail on a page you reached by scanning. Open the site yourself instead, from a bookmark or a search.
  • Where you can, switch important accounts to a passkey or hardware key, so a stolen password alone is not enough.
  • Check the destination before you visit it. That is what CheckThisQR does: it decodes the code in your browser, follows the redirects, and shows you where the link actually ends up.

If you already scanned and entered something

Act quickly, but calmly:

  • Close the page and do not re-enter anything.
  • Change any password you typed, from a device you trust, and turn on two-factor authentication where you can.
  • Sign out of all sessions on the affected account if the service offers it. A changed password does not always end a session an attacker already holds.
  • If a card or bank detail was involved, call your bank or card issuer and ask about disputing charges, then watch your statements.
  • If it happened on a work account, tell your IT or security team straight away, and say that you scanned a QR code — it tells them what to look for.
  • Tell the business or property owner where a physical code appeared so it can be removed.
  • Report the destination to Google Safe Browsing and, if money or identity was involved, to the FTC at reportfraud.ftc.gov.

For a fuller walkthrough, see I scanned a malicious QR code — what now?

Sources

Next step

See how it plays out in the real world

Read documented cases of quishing attacks — parking meters, restaurant menus, phishing emails, and fake delivery notices — or jump straight to checking a code right now.

See real scam examples →