Quishing

Quishing, or QR code phishing, replaces a visible link with a QR code that leads to a phishing page. The destination cannot be read until the code is scanned, and scanning usually happens on a personal phone, so the attack can slip past both email filters and the reader's own caution.

How it works

In email, the QR code is usually embedded as an image, which some filters do not decode, and paired with a message about multi-factor authentication, a document to sign, a payroll change or a voicemail. In the physical world, attackers stick their own codes over genuine ones on parking meters, charging stations, restaurant tables or posters. The code often points to a redirect or a URL shortener first and then to a fake login or payment page built for credential harvesting. Once the victim is on a phone, they are outside the company's managed devices and security tools, and the small screen makes the address hard to check.

Example

An illustrative case: an employee receives an email saying their authenticator app must be re-registered by the end of the day, with a QR code to scan. The phone opens examplecorp-mfa[.]com, which copies the company's sign-in page and captures both the password and the code. A second illustrative case: a sticker on a parking machine leads to exampleparking-pay[.]com, which asks for card details to "start the session".

How to spot it

• A QR code in an email asks you to sign in, re-register MFA or open a document.
• A sticker has been placed over another code, or a code appears somewhere unexpected.
• The link preview on the phone shows a domain unrelated to the organization.
• The page asks for credentials or card details immediately after scanning.
• The message stresses a deadline, such as account suspension today.

What brands can do

• Avoid QR codes in your own security and account emails, and say so publicly, so customers and staff learn that such requests are suspicious.
• Where you use QR codes on physical assets, use tamper-evident labels and inspect them regularly.
• Use email security that decodes QR images and checks their destinations.
• Monitor for domains that copy your login or payment pages, and get them taken down and blocklisted quickly.

The pages behind QR codes are ordinary phishing sites and can be removed the same way. Phishvoid verifies them and handles the takedown; contact the team for help. For more on suspicious links in general, read Phishing links and texts.

Read more: What Is a Phishing Link or Text? Smishing Explained