Cybersecurity

What Is Quishing? QR Code Phishing

Quishing is phishing that uses a QR code instead of a clickable link. You scan the code with your phone, and it takes you to a fake login page, a malicious download, or a payment page — the same traps as email phishing, hidden inside a square of black and white pixels. This guide explains why it works, where it appears, and how to stay safe.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

How quishing works

A QR code is simply a machine-readable link. In legitimate use, it takes you to a restaurant menu, a payment page, a ticket, or a Wi-Fi login. In quishing, the code leads to a fake login page or a malicious file. The scam usually starts with an email, a text or a printed notice carrying the code, with a message that creates urgency: your account needs verification, a document is waiting, a payment failed, a parcel needs a signature.

The trick works because QR codes bypass the defences people have learned for links. You cannot hover over a QR code to preview its destination, you cannot see a suspicious domain in it, and your email security software often cannot inspect what is encoded inside an image. By the time you see the destination, you have already left the safety of your inbox — and the fake page looks exactly like the real login screen.

Quishing also appears in the physical world. Attackers have stuck their own QR codes over genuine ones on parking meters, restaurant tables and public notices, so a scan meant to pay for parking instead opens a payment page controlled by a criminal. In offices, fake QR codes have been left in meeting rooms and on noticeboards, aimed at employees who scan without thinking.

Where you will meet quishing

The most common form is the email quishing message: a message that looks like it comes from a familiar service, with a QR code as the only way to act — scan to verify your account, scan to view a document, scan to update payment details. Because the dangerous link is inside an image, it often passes email filters that would have caught a plain text link.

The second form is the fake invoice or HR notice, aimed at workplaces: a message about a shared document or a security update, with a QR code to log in. The page it opens is a copy of a familiar login screen, and any credentials entered there go straight to the attacker. The third form is physical: codes stuck over real ones in car parks, cafes, museums and public charging points.

Any QR code in an unexpected message should be treated like an unexpected link — because that is what it is. A QR code from a source you trust, in a place you trust, for a reason you understand, is normally fine. A QR code that arrives uninvited, with urgency attached, is not.

Why email filters often miss it

Email security tools inspect links and attachments, but a QR code is an image. The dangerous address is encoded in the pattern of squares, not written anywhere the filter can read, so many filters simply cannot see it. Attackers know this and use it deliberately. Some campaigns even put the QR code in a PDF attachment, adding another layer between the filter and the destination.

This matters for workplaces too. A company that blocks malicious links in email may still let a quishing message through, because there is no link to block. The defence is not a better filter but a better habit: treat every QR code from an unexpected message as untrusted, and never use it to log in to anything important.

How to check a QR code before you scan

First, ask whether you expected it. A QR code on a parking meter you are standing next to, or on a menu in a restaurant you are sitting in, fits its context. A QR code in an unexpected email, text or letter does not — and context is the first check. Second, if you do scan, look carefully at the preview your phone shows before you open it. Most phones display the address the code points to; if it is a shortened link, an unfamiliar domain, or a lookalike of a real brand, stop.

Third, never scan a code to log in to an account. If a message says you must scan to verify your account, open the official app yourself instead and check whether anything needs your attention — it almost certainly does not. Fourth, on payment codes, check the recipient before you confirm: a parking payment should go to the parking operator, not an individual. Fifth, use your phone's built-in scanner rather than a random scanner app, and keep your phone's security software active.

• Only scan codes you expected, in a place that makes sense.
• Read the address preview your phone shows before opening it.
• Never scan a code to log in — use the official app instead.
• Check the payment recipient before confirming anything.

What to do if you scanned a bad code

If you scanned a code and landed on a login page, close it without entering anything. If you did enter credentials, change the password immediately from the real site or app, change it anywhere else you reused it, and turn on two-factor authentication. If you entered payment details, contact your bank straight away. The full steps are in our guide on what to do if you clicked a phishing link — a scanned code is the same situation as a clicked link.

If you downloaded something after scanning, do not open it. Disconnect from the internet, run a full scan with your security software, and on a work device tell your IT team. Then report the message: in the UK, forward the email to [email protected]; in the US, report it to the FBI Internet Crime Complaint Center at ic3.gov. Physical stickers should be reported to the business or council responsible for the location, and photographed first if it is safe to do so.

Quishing at work: what teams should do

For employers, quishing deserves a line in the security guidance alongside email phishing: never scan a QR code in an unexpected message to log in, and never scan a code on a notice or in a meeting room without checking it belongs there. IT teams can add the same guidance to onboarding and to the reporting process, so employees know where to send suspicious codes.

It also helps to give staff a safe alternative. If documents genuinely need sharing by QR code, use a known channel — the company intranet, a named system — and say so in advance. When people know what a legitimate code looks like in their workplace, an illegitimate one stands out. And if a quishing message does get through, a quick internal warning turns one report into protection for the whole team.

Sources

• National Cyber Security Centre (UK) — Phishing guidance — last checked 14 November 2026.
• Federal Trade Commission — How to recognise phishing — last checked 14 November 2026.
• FBI Internet Crime Complaint Center — IC3 — last checked 14 November 2026.

Last checked: 14 November 2026.

Frequently asked questions

What is quishing?

Quishing is phishing that uses a QR code instead of a clickable link. The code leads to a fake login page, a malicious download or a payment page controlled by a criminal. It is the same fraud as email phishing, hidden inside an image.

Why is quishing hard to detect?

A QR code is a link you cannot read. You cannot hover over it to preview the destination, and many email security filters cannot inspect the address encoded inside an image, so quishing messages often pass filters that would catch a plain link.

Are QR codes safe in restaurants and car parks?

Usually, yes — if the code is where you expect it, in a place you trust. The risk is a sticker placed over the real code. Look for codes that look tampered with, and check the payment recipient before confirming any payment.

Should I scan a QR code to log in to an account?

No. Never scan a code from an unexpected message to log in. Open the official app yourself and check whether anything needs your attention. A genuine account issue will be visible there.

How do I check where a QR code leads?

Most phones show a preview of the address before opening it. Read it: if it is a shortened link, an unfamiliar domain, or a lookalike of a real brand, do not open it.