QR Quishing and Phishing Explained

Introduction

QR codes were designed to make life easier. Point your camera, open a page, pay a bill, join Wi-Fi, or pull up a menu. That speed is exactly why attackers love them. QR code phishing, also known as quishing, turns a harmless square into a shortcut to credential theft, payment fraud, and device compromise. You scan because the code looks official. A logo sits nearby. The promise is simple, pay here or track your parcel. In seconds, you are typing a password or card number on a page that looks right but is not.

Quishing succeeds because it moves the moment of decision away from your protected desktop to your phone. Your email gateway may block suspicious links in messages on your laptop. It will not stop you from scanning a printed sticker on a parking meter or an image in a forwarded email that hides its URL inside a QR pattern. On a small mobile screen, domains truncate, brand marks are tiny, and subtle typos are tougher to spot. Attackers design their pages for this reality. They keep the flow fast and the pressure high.

This guide explains how quishing works, why it is rising, and how to stop it with practical controls. We walk through the attacker playbook from code placement to credential capture. You will learn how to recognize red flags in the moment, even on a phone. We map the defenses that matter most, from QR-aware email filtering to phishing resistant MFA. We also include training scenarios you can copy, with normal versus vulnerable examples that make the risk concrete for your team.

If you run security, you will find a prioritized checklist and a buyer’s guide for tools that understand QR threats. If you manage facilities, you will get a physical inspection routine that catches tampered signage before it hurts staff or visitors. If you are a daily user, you will leave with simple habits that keep scans safe. Pause. Preview the domain. Proceed only if it checks out. Prefer official apps for payments and deliveries.

How quishing works, in three steps

TL;DR

Definition: Quishing is phishing that uses a QR code to lure you to a spoofed website or malicious app. Attackers print or embed a code on emails, posters, invoices, parking meters, delivery notes, or packaging. You scan, land on a fake site, and enter credentials or payment details. Because the scan happens on your phone, outside many enterprise defenses, detection is harder. Microsoft reported a surge in email-borne QR code phishing from September 2023, peaking at about 3 million blocked attempts a day before QR-aware detection cut that to about 200,000 a day. Physical quishing keeps growing: in the UK, Action Fraud reports of QR code scams more than doubled in 2024, according to The Guardian.

Spoofed sites can also rely on lookalike Unicode characters, a technique covered in our homoglyph attack guide.

Why quishing is surging now

• Scanning feels safe. People assume printed codes are vetted.
• Mobile first. You scan on a phone, then authenticate to cloud apps, all away from desktop protections. Microsoft
• Easy to plant. A single sticker in a busy car park can reach many drivers. In 2024 to 2025, UK police and media documented fake “pay here” parking codes that stole card data. Action Fraud received 1,386 reports of QR code scams of all kinds in 2024, more than double the previous year. The Guardian
• New delivery tricks. The FBI warned in July 2025 about unsolicited packages with QR codes, often with no sender details, that lead victims to hand over personal and financial information or install malware. Internet Crime Complaint Center+1
• Broad adoption. Billions of phones and contactless habits keep QR usage high, which increases attacker payoff.

DeepStrike's Red Teaming Services can include phishing and social engineering scenarios and, where agreed in scope, physical social-engineering tests such as QR code lures, and measure how your SOC detects and responds.

How a quishing attack actually works

1) Seeding the QR code

Attackers place a code on a surface people trust, or inside an email image that looks like a legitimate notice. Examples include parking meters, restaurant tables, shipping labels, service tickets, gift cards, and corporate posters in lobbies. Recent cases show fake parking codes that led drivers to phishing payment pages. The Guardian

What you see: A clean code, a brand logo, and a short call to action like “Pay here,” “Track your parcel,” or “Verify account.”

What is happening: The code hides a URL that looks close to a real brand. Some codes route through a link shortener or multiple redirects before the final page.

2) The mobile detour

You scan with your camera or a reader. Your phone opens the site in a small browser tab. On mobile, URL bars truncate, and brand cues are smaller, so warning signs are easy to miss. Microsoft notes that warning signs users might notice on larger screens often go unnoticed on mobile devices. Microsoft

3) Harvest or payload

• Credential pages copy login flows, MFA prompts, or SSO portals.
• Payment pages mimic parking or courier sites.
• Malware pages push APKs on Android or prompt risky profiles on iOS.

Real-world data points: FBI advisories describe QR-led scams tied to unsolicited deliveries. UK reporting shows Action Fraud received 1,386 reports of QR code scams of all kinds in 2024, more than double the year before. Car park codes are a common theme, and individual losses can be large; one victim told the BBC fraudsters ran up £13,000 of debt in her name.

Red flags to spot before and after scanning

• Stickers over prints. Look for misaligned or glossy stickers on public signage.
• Odd domains. Look for misspellings, extra hyphens, or unrelated TLDs when the page opens.
• URL shorteners. Multiple hops or shortened links that hide the destination.
• Pressure language. “Verify in 10 minutes,” “Final notice,” “Parking penalty due now.”
• App sideload prompts. Pages that try to install non-store apps or profiles.

Tip: If a code is on a meter, poster, or table, verify the URL on the vendor’s official page or app store listing before you pay.

Common quishing scenarios with “safe vs unsafe” walkthroughs

A) Parking payments

• Safe flow: Meter signage shows an official app or embedded NFC contactless icon. The URL resolves to the city, operator, or well-known parking brand domain.
• Unsafe flow: A small sticker reads “Scan to pay.” The URL opens examp1e-parking-pay[.]example or a short link that lands on a domain unrelated to the operator. The page asks for full card details and security code, then sets up recurring charges. These patterns have been observed in multiple UK incidents in 2024 and 2025. The Guardian

B) Delivery re-routes

• Safe flow: Carrier SMS from a known shortcode with a link on the carrier’s official domain.
• Unsafe flow: Unsolicited package with a QR tag instructs “Scan to confirm address” (an illustrative lure). The code lands on a credential harvest form. The FBI warned about QR codes on unsolicited packages in 2025. Internet Crime Complaint Center

C) Corporate posters and invoices

• Safe flow: Internal AI posters link to an intranet domain. Invoices contain the same payment URL your vendor uses every month.
• Unsafe flow: A hallway poster with a fresh sticker, or an emailed invoice image with a QR code that lands on an unrelated payments site.

How attackers bypass controls

• Email link filters. Many secure email gateways filter URLs in text, not in QR images. Quishing emails put the malicious link inside the image. Microsoft documents this tactic and now flags QR indicators in Defender for Office 365. Microsoft
• Mobile session pivot. Victims move from desktop to phone, where corporate controls and password managers may be weaker.
• Look-alike domains and fast infra. Disposable domains, link chains, and image-only emails reduce the signals defenders rely on.

Prevention that works, prioritized

1) Make QR codes first-class citizens in your defenses

• Block or rewrite QR URLs in email. Use a gateway or API that extracts and detonates URLs found inside images. Defender for Office 365 and similar products now include QR-specific training and analytics.

• Add a QR check to phishing simulation training. Run quarterly campaigns with physical stickers in hallways and emails that contain QR images. Measure scan rates, not click rates. Hoxhunt and others publish QR simulation templates. Structure the exercise as a Red Team vs Blue Team drill so you also learn whether defenders detected the scan.

2) Harden identity

• Use phishing-resistant MFA. Prefer passkeys, FIDO2 security keys, or platform authenticators. Microsoft recommends passwordless options to reduce credential theft risk across all phishing variants, including quishing. Microsoft
• Shorten sessions and alert on unusual mobile logins. Watch for SSO from new mobile devices after a QR-led event.

3) Lock down the physical world

• Audit public signage. Parking areas, lobbies, cafeterias, and visitor kiosks are high-risk. Maintain a register of approved stickers and posters.
• Use tamper-evident design. If you publish QR codes, print directly on the sign, or use holographic seals that break when removed.

4) Empower users with one screen of guidance

• Teach the “pause, preview, proceed” habit.
• Always peek at the domain.
• Prefer official apps for payments.
• Never install apps from a web page after scanning.

5) Prepare the incident path

• If credentials may be exposed, rotate and revoke refresh tokens.
• If payment data may be exposed, notify the card issuer, then your fraud contact.
• Report the code location to facilities or local authorities, and to the FBI IC3 if in the US.

A quick buyer’s guide for QR-aware controls

• Email security: Look for OCR or computer vision that extracts and follows QR-embedded URLs. Confirm sandboxing works on mobile-only redirects. Microsoft Defender and similar tools publish guidance specific to QR threats.
• Mobile management: Enforce managed browsers, block sideloading, and restrict risky device profiles.
• DNS and web filtering: Expand allowlists for payment providers you trust, alert on look-alike domains.
• Awareness platform: Include QR scenarios in simulations and micro-lessons.

Examples you can use in training

Scenario 1: Parking

• Normal output: https://pay.example-parking.example/zone/12345 (a fictional operator domain for training; check the sign for the operator’s official app or website, and enter the location code yourself where possible)
• Vulnerable output: https://examp1e-parking-pay.example/zone/12345?session=... → card form that asks for CVV.

Scenario 2: Delivery

• Normal output: https://www.dhl.com/track?AWB=...
• Vulnerable output: https://dhl-track-support.example/verify → asks for email password to “release parcel.”

Scenario 3: Corporate survey

• Normal output: https://forms.microsoft.com/r/...
• Vulnerable output: https://microsoft-forms.work-survey.example → SSO look-alike.

Use this trio in tabletop drills. Show screenshots of the mobile URL bar and make the team identify the tell.

“If you only do five things” checklist

1. Enable QR-aware URL extraction in email security.
2. Move to phishing-resistant MFA, start with admins and finance.
3. Run a quarterly QR simulation that includes physical stickers.
4. Publish an employee micro-guide on safe scanning.
5. Add a facilities sweep for tampered QR stickers in public areas.

Conclusion

Quishing shifts phishing from the inbox to your phone, using the trust of physical spaces and the constraints of small screens. Defenses work best when you treat QR codes as a first-class threat. Add QR-aware email filtering, run realistic QR simulations, move to phishing-resistant MFA, and audit public signage. If you make these steps routine, QR codes become less of a trap and more of a tool.

FAQs

Is scanning any QR code safe?
No. You cannot see the destination without scanning. Treat public codes as untrusted, verify the domain, and prefer official apps for payments.

Can email security stop quishing?
It can block many email-delivered QR codes if it extracts and analyzes URLs inside images, but it cannot see printed codes, so pair it with training and physical checks.

What if I already scanned and entered data?
Change the related passwords, revoke sessions, notify your bank if you entered card details, and report the incident. In the US, file at IC3.

Are QR codes themselves malicious?
The code is just a pointer, the risk comes from where it points. Attackers rely on trust in physical spaces and small mobile screens.

Which MFA stops quishing?
Phishing-resistant MFA, such as passkeys or security keys, stops a fake page from reusing captured credentials. It does not protect card details or stop malware installs.