QR Code Phishing (Quishing): Why It Works and How to Stop It

For a decade, security awareness programs drilled one habit into employees: hover over the link before you click. QR code phishing — quishing — exists because attackers found the loophole in that habit. There is nothing to hover over. The URL is encoded in a square of pixels, the destination is invisible until scanned, and the scan happens on a phone that is usually outside the corporate security stack entirely.

The technique has moved from novelty to mainstream at speed. Microsoft's Q1 2026 email threat report recorded QR code phishing volumes rising from 7.6 million attacks in January to 18.7 million in March — a 146% increase in a single quarter, against a backdrop of 8.3 billion email phishing threats overall. And with the Verizon 2026 Data Breach Investigations Report attributing 62% of breaches to the human element, a channel that reliably beats both filters and habits deserves a specific defense plan.

This guide covers how quishing actually works, why it evades controls that stop ordinary phishing, and what a layered defense looks like in practice.

Why a QR code is a near-perfect phishing payload

Three properties make QR codes unusually attractive to attackers.

The URL is opaque to humans. Every anti-phishing habit that involves reading — checking the domain, spotting the typo, noticing the URL shortener — fails when the link is a graphic. The victim's first chance to inspect the destination comes after the scan, on a phone screen, in a small address bar that truncates long deceptive domains.

The URL is opaque to filters. Secure email gateways were built to parse and reputation-check links in text and HTML. A URL encoded in the pixels of an image inside a PDF is invisible to any scanner that does not render the attachment and decode the code. Microsoft's telemetry shows attackers leaning hard into this gap: PDF attachments carried 65–70% of QR code phishing in early 2026, and QR codes embedded directly in email bodies surged 336% in March alone.

The scan jumps devices. This is the subtle one. The email lands on a managed laptop, but the victim completes the attack on a personal phone — typically without the corporate proxy, EDR agent, or browser protections that would have flagged the page on the desktop. The attacker effectively chooses the least-defended device in the victim's life, and the victim carries the attack there voluntarily.

A QR code is a link your security stack cannot read, scanned on a device you probably do not manage. That combination — not the code itself — is the threat.

Defenders have adapted, and it shows in the data: at the peak of the first quishing wave, Microsoft Defender for Office 365 was blocking 3 million QR phishing attempts per day, a figure that fell 15-fold to around 200,000 daily once image-rendering detections shipped. But the Q1 2026 rebound shows the pattern of this arms race: attackers rotate payload formats faster than most organizations rotate defenses.

Anatomy of a quishing attack

The lure

Quishing lures exploit contexts where a QR code feels natural or where urgency short-circuits scrutiny:

Lure	Delivery	What the victim expects
"Your MFA enrollment expires today — scan to re-register"	Email, often a PDF "IT notice"	A routine authenticator setup
Fake invoice or payment remittance	PDF attachment	A billing document
Shared document or voicemail notification	Email body QR	A Microsoft 365 / Google login
Parking fine or toll payment notice	Email, SMS, or physical sticker	A quick official payment
Unsolicited package insert	Physical mail	Sender or warranty information

The MFA-themed lure is the workhorse: it targets exactly the moment when scanning a QR code with your phone is expected behavior, because that is how legitimate authenticator enrollment works.

The scan and the harvest

The code resolves to a credential-harvesting page — most often a pixel-perfect Microsoft 365 or Google Workspace login. Increasingly, that page is an adversary-in-the-middle (AiTM) proxy: it relays the victim's input to the real login service in real time, letting the victim complete MFA, then steals the resulting session cookie. The attacker gets an authenticated session, not just a password. Microsoft's Q1 2026 data shows credential phishing at 89–95% of all malicious email payloads — quishing is overwhelmingly an identity attack, not a malware one.

Quishing has left the inbox

Unlike most phishing, quishing works on paper. The FBI first warned in a January 2022 IC3 alert that criminals were tampering with legitimate QR codes on parking meters and payment signage, redirecting payments and harvesting card data. In July 2025, IC3 flagged a newer variant: unsolicited packages — a twist on brushing scams — containing no sender information, just a QR code the recipient is meant to scan to find out who sent the mystery gift. Scanning leads to data-harvesting forms or malware downloads.

For offices, the physical vector is worth taking seriously precisely because nobody owns it. A sticker in a lobby, a poster in the lift, a code on a "new canteen menu" — physical QR codes fall between facilities and security, and employees extend workplace trust to anything printed inside the building. It matters most where the printed code is the only channel that reaches someone: training clinical staff between shifts and reaching a plant floor where many roles have no mailbox both depend on it. These attacks blend with the broader mobile-first social engineering wave we covered in our guide to vishing and smishing attacks: the phone is now where the human layer is thinnest.

How to defend: a practical playbook

1. Close the filter gap. Confirm your email security actually renders images and attachments and extracts QR code destinations for URL analysis — this is now table stakes in Microsoft Defender for Office 365 and equivalent products. If your gateway cannot tell you how many QR-borne URLs it analyzed last month, assume the answer is zero.

2. Train the specific reflex, not generic caution. The teachable behavior is concrete: a QR code in an email is a red flag in itself — legitimate services almost never need one, because you are already on a device that can click a link. For physical codes, teach employees to read the URL preview their camera shows before opening. Fold this into continuous security awareness training rather than a one-off bulletin.

3. Simulate quishing both digitally and physically. Employees who have safely failed against a simulated QR lure recognize the real one. NOUSEC simulations support QR scenarios across email-embedded and printed delivery — the poster in the kitchen teaches a lesson no slide deck can.

4. Make stolen credentials worthless. Because AiTM kits defeat push- and code-based MFA, the durable fix is phishing-resistant authentication — FIDO2 keys or passkeys — for privileged and finance roles first, plus conditional access policies that block unfamiliar devices and locations from completing risky sign-ins.

5. Measure who scans, and respond fast. Feed simulation results and real incident reports into a human risk score so repeat scanners get targeted coaching instead of another all-hands email. And when someone does scan a live lure: reset the password, revoke active sessions and refresh tokens (the AiTM step most teams miss), check the device in MDM, and report the campaign — in the US, to IC3.

The bottom line

Quishing is not a new kind of deception — it is the oldest kind, wrapped in a format that current controls and current habits were not built for. The organizations that handle it well treat it as three problems at once: an email filtering problem (decode the image), a mobile identity problem (make sessions phishing-resistant), and a human behavior problem (build the scan-with-suspicion reflex through realistic practice). Solve all three, and a 146%-a-quarter growth curve becomes someone else's problem.