--- id: CP-006 slug: quishing-qr-code-phishing lang: en title: "Quishing: QR code phishing" description: A booby-trapped QR code hides its address inside an image and leads to a fake login page. How to spot it and what to do before scanning. canonical_url: https://startbrain.io/cyberpedia/en/articles/quishing-qr-code-phishing/ markdown_url: https://startbrain.io/cyberpedia/en/articles/quishing-qr-code-phishing.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: "Brain, \"Quishing: QR code phishing\", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/quishing-qr-code-phishing/ (CC BY 4.0)" wing: 1 theme: detect_phishing reflex: cr-006 schema: G1 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/quishing-qr-code-phishing/ fr: https://startbrain.io/cyberpedia/fr/articles/quishing-qr-code-pieges/ de: https://startbrain.io/cyberpedia/de/articles/quishing-qr-code-falle/ es: https://startbrain.io/cyberpedia/es/articles/quishing-codigo-qr-trampa/ sources: - "n": 1 title: What Is Quishing (QR Phishing)? Definition | Proofpoint US publisher: Proofpoint url: https://www.proofpoint.com/us/threat-reference/quishing published: "2025-03-31" accessed: "2026-11-03" - "n": 2 title: Recognize and Report Phishing | CISA publisher: CISA url: https://www.cisa.gov/secure-our-world/recognize-and-report-phishing accessed: "2026-11-03" - "n": 3 title: "Phishing scams: how to spot and report them" publisher: NCSC (United Kingdom) url: https://www.ncsc.gov.uk/collection/phishing-scams published: "2021-11-26" accessed: "2026-11-03" - "n": 4 title: "Phishing attacks: defending your organisation" publisher: NCSC (United Kingdom) url: https://www.ncsc.gov.uk/guidance/phishing published: "2018-02-05" accessed: "2026-11-03" - "n": 5 title: Phishing, Technique T1566 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1566/ accessed: "2026-11-03" --- # Quishing: QR code phishing Quishing is a phishing attack that uses a QR code. The code is an image: it does not show the address it contains, and the user cannot see it in advance [1]. For an employee, the trap is an ordinary gesture. You scan a code received in an email, stuck on a poster or slipped into a shared document, and you land on a page that asks you to sign in or pay [1]. ## In 30 seconds - Where it happens: emails, text messages, fake invoices, posters, menus, product labels, shared PDFs or spreadsheets [1]. - What the attacker wants: to send you to a fake login page, or to get you to download malicious software [1]. - The reflex: before scanning a code, check where it comes from through another channel, for example by calling the sender [1]. - If it is already done: do not enter credentials or payment details until the site's authenticity is confirmed [1]. Report the message, then delete it without replying [2]. ## Straight answers ### What is quishing? It is phishing through a QR code. Proofpoint describes it as a social engineering attack that redirects victims to malicious sites or triggers malware downloads. Unlike classic phishing, which relies on links written out in plain text, it uses an image code [1]. ### Why is a QR code harder to judge than a link? Because the address is invisible. Proofpoint notes that the user cannot see the URL contained in the code in advance, which makes the tool exploitable [1]. ### Why do company filters not always catch it? According to Proofpoint, quishing bypasses email filters [1]. Tim Bedard of IBM Expert Labs, quoted on the same page, explains that email security tools look for known suspicious links in messages, but do not analyse images to find links hidden in a QR code [1]. Specialised solutions exist: they extract QR codes from emails and from attachments such as PDFs, decode the address and assess its risk [1]. ### Is my personal phone affected? Yes. Proofpoint writes that this tactic leaves organisations vulnerable through both work devices and personal devices [1]. The page does not detail this point further. ### What should I do before scanning? Proofpoint advises confirming a code's legitimacy with the sender through another channel, such as a phone call, before scanning a code received by email, by text message or in a public place [1]. CISA adds a general rule: if a message could be real, do not click any link or call any number it contains, and find another way to reach the company or the person [2]. ### What if the code looks suspicious? CISA recommends reporting the message, then deleting it without replying [2]. The UK NCSC points out that reporting a scam message is free and takes a minute, and that it has the power to investigate fraudulent addresses and sites in order to have them taken down [3]. In a company, Proofpoint recommends clear channels so that employees can report a suspicious code without fear of reprisals [1]. The NCSC observes for its part that employees who fear for their jobs do not report their mistakes [4]. ## Inside the attacker's head According to Proofpoint, the method follows four steps [1]. - Create the code. Free online tools produce QR codes that point to a phishing site or to a domain hosting malware. - Distribute it. The code is placed in a phishing email, on a fake invoice, on a poster, on a restaurant menu, or stuck over a legitimate QR code. - Push for speed. Messages call for immediate action, for example "Scan to unlock a discount" or "Verify your account". - Exploit the scan. The victim lands on a fake login page, a credential harvester or a malware download. MITRE ATT&CK lists phishing among the initial access techniques. It describes sender spoofing, which can fool both the recipient and automated security tools, and "thread hijacking": the attacker includes the target in an existing conversation whose messages contain malicious files or links [5]. The MITRE page consulted does not mention QR codes: these tricks are those of phishing in general. ## What you see on screen The typical message asks you to scan a code, often with a pressing reason. Proofpoint cites "Scan to avoid account suspension" as an example of an urgency-based lure [1]. Codes also come as "account verification" alerts or shipping notices, with a bank, a government agency or a supplier as the apparent sender [1]. In public places, Proofpoint cites restaurant menus, parking meters, shop posters and event flyers, with promises of discounts, WiFi access or exclusive content [1]. Inside the company, codes can hide in internal PDFs or spreadsheets posing as surveys or training material [1]. Once the page is open, CISA lists the classic signs of phishing: urgent or emotional language, a request for personal or financial information, untrustworthy shortened addresses, and misspelled addresses or links such as "amazan.com" [2]. Proofpoint cites "arnazon.com" [1]. CISA specifies that the old sign of spelling mistakes is no longer reliable: in the age of artificial intelligence, some emails have perfect grammar [2]. The NCSC warns that no training will let people spot every attempt, and that examining every email in detail would leave too few hours for the actual work [4]. ## Under the hood A QR code is a machine-readable matrix that can hold up to 7,089 numeric characters or URLs, and can be read with a smartphone camera or a reader app. Its design includes error correction, which lets it work even when partly damaged [1]. On the defence side, Proofpoint describes several layers. Analysis engines use computer vision models to find QR codes in emails, decode the addresses and assess their risk. Online sandboxing extracts codes from attachments and simulates a visit to the addresses in an isolated environment before delivery. According to Microsoft, quoted by Proofpoint, this pre-delivery check blocked about 1.5 million quishing attempts a day in 2024 [1]. Against credentials stolen on these fake pages, Proofpoint recommends multifactor authentication, and the DMARC, SPF and DKIM protocols against spoofed emails [1]. The NCSC explains that DMARC stops phishers from spoofing an organisation's domain, and that several layers of defence are needed rather than relying on users' eyes alone, because some attacks will always get through [4]. ## Case files ### 2023: fake company invoices Proofpoint reports a 2023 attack that imitated company invoices. Employees were directed to fake payment portals [1]. The page names neither the targeted company nor the author of the attack. ### 2024: restaurant menus covered over According to Proofpoint, a 2024 campaign targeted restaurant chains by placing malicious QR codes over printed menus. Customers were redirected to credential-harvesting pages that imitated loyalty programmes [1]. Again, the source gives no chain name. These two cases come from a single commercial source, which gives no victim figures. The UK NCSC also published a post on 8 February 2024 titled "QR Codes - what's the real risk?", of which the page consulted reproduces only the title and a teaser sentence [3]. ## Sources 1. Proofpoint, "What Is Quishing (QR Phishing)? Definition | Proofpoint US", 31 March 2025. https://www.proofpoint.com/us/threat-reference/quishing (accessed 3 November 2026) 2. CISA, "Recognize and Report Phishing | CISA". https://www.cisa.gov/secure-our-world/recognize-and-report-phishing (accessed 3 November 2026) 3. NCSC (United Kingdom), "Phishing scams: how to spot and report them", 26 November 2021. https://www.ncsc.gov.uk/collection/phishing-scams (accessed 3 November 2026) 4. NCSC (United Kingdom), "Phishing attacks: defending your organisation", 5 February 2018. https://www.ncsc.gov.uk/guidance/phishing (accessed 3 November 2026) 5. MITRE ATT&CK, "Phishing, Technique T1566 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1566/ (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/quishing-qr-code-phishing/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.