Quishing is phishing carried out through malicious QR codes, printed on stickers placed over legitimate ones or embedded in emails, that send the victim to a credential-harvesting or malware site. QR codes hide the real destination and often slip past email link scanners, which is exactly why attackers reach for them.
What is quishing, in plain English?
Quishing is phishing where the malicious link is hidden inside a QR code instead of shown as text. The victim scans the code with their phone camera and is taken to a page that harvests their login, payment details, or installs malware, just like a phishing link, but with the destination concealed until it is opened. The name is a blend of QR and phishing.
The delivery is what makes it clever. Attackers place printed stickers over real QR codes on parking meters, restaurant tables, invoices, and posters, or they embed a QR image in an email. Because a code is a picture rather than a clickable link, it commonly evades the URL scanners that inspect email links, and it moves the victim from a monitored work computer onto a personal phone that has fewer protections.
In the fraud stack, quishing is a variant of phishing that shares the same goal, credential theft or malware, but exploits two gaps: the QR code hides the URL from the human, and the image format hides it from many automated filters. Everything after the scan is standard phishing, so the same anti-phishing checks apply to the page it lands on.
How a quishing attack works
- Craft — Build the malicious code. The attacker generates a QR code pointing to a credential-harvesting or malware page.
- Place — Put it where it is trusted. The code is printed on a sticker over a legitimate one, or embedded in an email, invoice, or poster.
- Scan — The victim opens it. The victim scans with their phone, and the hidden URL loads on a device with fewer filters.
- Harvest — Capture and exploit. The page steals credentials or payment details, or delivers malware, feeding account takeover.
What it looks like in practice
In practice
An employee receives an email that appears to be an internal notice to re-verify their account, with a QR code and a line saying to scan it to complete the check. Because the message contains an image rather than a link, it passes through the email link filters untouched.
The employee scans the code on their personal phone and lands on a page that looks like the company sign-in. They enter their credentials and a one-time code, which a relay kit forwards to the real system. The attacker now holds a working session, and the only unusual artifact in the mail flow was a harmless-looking image.
Why it matters for operators
Quishing exploits a blind spot in layered email security. Link scanners that catch text URLs often do not decode QR images, so a malicious code can sail through controls that would have blocked the same link in text form. It also shifts the victim onto a personal phone, away from managed browsers and endpoint protection, which weakens the defenses at the moment of the click.
For teams, the response is to extend anti-phishing thinking to codes. Train people to preview the decoded URL before opening it and to treat unexpected QR prompts, on an invoice, a parking meter, or an email, with the same suspicion as an unexpected link. Where possible, decode QR images in email security tooling, and apply the same page-level checks, domain reputation, certificate, and credential-prompt scrutiny, to wherever the scan leads.
What to watch for
- QR codes in emails. An unexpected code asking you to scan to log in or verify is a common quishing delivery, especially when it replaces a normal link.
- Stickers over real codes. A QR sticker that looks added or misaligned on a meter, menu, or poster may cover the legitimate one.
- Personal-device logins. A credential prompt that appears after scanning a code on a phone should be verified before entering anything.
- Hidden or shortened destinations. A decoded URL that is a shortener or a lookalike domain is a strong warning sign.
- Urgency after a scan. Pages that pressure immediate login or payment following a QR scan carry the usual phishing hallmarks.
Quick questions
How is quishing different from regular phishing?
The goal is identical, but the malicious link is delivered as a QR code rather than text. That hides the destination from the victim and often from email link scanners, and it moves the victim onto a personal phone.
Why do QR codes evade email filters?
Many link scanners inspect text URLs but do not decode the URL embedded in an image. Because the code is a picture, the malicious address is invisible to those filters unless the tooling specifically reads QR images.
How can someone check a QR code safely?
Use a scanner or camera that previews the decoded URL before opening it, and inspect that address for lookalike domains or shorteners. If anything looks off, do not open it.
Are physical QR codes really tampered with?
Yes. A common tactic is placing a sticker with a malicious code over a legitimate one on parking meters, restaurant tables, or posters, so the location looks trustworthy while the code is not.
Does phishing-resistant login help here too?
Yes. FIDO2 and passkeys bind the login to the correct domain, so even if a victim scans a code and reaches a convincing fake page, the credential will not work on the wrong site.
What should a user do after scanning a suspicious code?
Do not enter credentials or payment details. Close the page, and if anything was submitted, change the password and report it so the account can be watched for takeover.
Go deeper
- FTC Consumer Advice: Scams ↗ — US consumer guidance on current scams and fraud, and how to report them.
- FBI IC3 ↗ — The FBI Internet Crime Complaint Center. Fraud reporting and annual trend reports.