What is QR code phishing (quishing), and how do you stop it?

A QR code in an email looks harmless: a square of black and white dots, no suspicious link to hover over. That's exactly why criminals use it. This guide explains how QR code phishing ("quishing") works, why it can slip past link scanners, what US and UK government agencies advise, and the training and technical controls that reduce the risk.

What is QR code phishing?

Quishing is ordinary phishing with one twist: the malicious link is encoded in a QR code instead of written as text. The FBI's Internet Crime Complaint Center warned in 2022 that "cybercriminals tamper with both digital and physical QR codes to replace legitimate codes with malicious codes," sending victims to sites "that steal login and financial information" (IC3 PSA).

The FTC describes the same pattern in email and text messages. Its December 2023 alert lists common lures: a package that couldn't be delivered, an account problem that needs verification, or suspicious activity that requires a password change (FTC). The aim is urgency, so you scan before you think.

In a business inbox, quishing emails usually look like one of these:

The FBI notes that malicious QR codes "may also contain embedded malware," so a fake page isn't the only risk. Its advice includes downloading apps only from your phone's app store, never from a QR code.

Why do link scanners miss QR codes?

Most email filtering was built around text: it extracts URLs from the message body, checks them against reputation lists and may rewrite them for time-of-click checks. A QR code breaks that model in three ways.

The link is an image

There's no URL in the message text for a scanner to read. Something has to find the image, decode it and then check the link. The UK NCSC puts it plainly: "Not all security tools designed to detect phishing emails will scan images" (NCSC). A code inside a PDF or document attachment adds another layer to unpack.

The click moves to a phone

You can't scan a QR code on your laptop screen with your laptop. You pick up a phone. The NCSC notes that "users are more likely to use their personal phone to scan the QR code," and that personal devices "may not have the same security protections as a computer that's provided by your employer." Web filtering, endpoint protection and logging on the work computer never see the visit.

Phones make bad links harder to spot

The CISA, NSA, FBI and MS-ISAC phishing guidance notes that it "can be difficult for a user to detect malicious uniform resource locators (URLs)" on small mobile platforms with constrained interfaces. A long or lookalike domain is easy to miss on a phone screen.

Put together, quishing shifts the click from a protected, monitored device to an unprotected one, and from a channel your filter understands to one it may not.

What do the FBI, FTC, CISA and NCSC advise?

The official advice is consistent. Here is what each agency says, in their own guidance.

None of the agencies says "never scan a QR code." The NCSC suggests codes in a pub or restaurant are probably fine. The common thread is context: an unexpected code in an email asking you to sign in or pay is a red flag.

How do you train users to spot quishing?

Keep the message short. People remember rules, not slide decks.

Rules for staff

1. Treat a QR code like a link. If you wouldn't click a link in that email, don't scan the code.
2. Never sign in through a QR code. Our IT team will never ask you to scan a code to reset a password, re-register MFA or view a shared file. Open the service from a bookmark or by typing the address.
3. Check the address before you enter anything. The FBI advises checking the URL after scanning to make sure it's the intended, authentic site. Look for misspellings and lookalike domains. If in doubt, stop.
4. Use your phone's built-in camera. The FBI suggests avoiding third-party QR scanner apps.
5. Don't install apps from a QR code. Use the official app store.
6. Report it. Use the report button in your mail app, even if you already scanned it. If you entered a password, tell IT straight away.

Make reporting safe

The NCSC's phishing guidance for organizations says training should reassure users "that they won't get in trouble if they report phishing incidents." Someone who scanned a code and reports it within minutes gives you time to reset the account. Someone who stays quiet doesn't.

Include QR code examples in your phishing awareness material. CISA's guidance recommends user training on social engineering and phishing, and for smaller organizations a standard program that employees review annually.

Which technical controls reduce quishing risk?

Training lowers the click rate. These controls limit what happens after the click, or stop the message arriving.

1. Ask how your email filter handles images

Ask your mail provider or filtering service directly: does it detect QR codes in message images and attachments, decode the link and check it like any other URL? If the answer is unclear, assume some quishing will reach inboxes and lean harder on the other controls. Our explainer on how spam filters work covers the layers involved.

2. Phishing-resistant MFA

Most quishing aims to steal a password, and often a one-time code, on a fake sign-in page. CISA's guidance recommends MFA and prioritizes phishing-resistant MFA for administrator and privileged accounts. CISA's phishing-resistant MFA fact sheet (October 2022) says "the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication," which includes security keys and authenticators built into phones and laptops. Start with admins, finance and executives.

3. Block known bad destinations

CISA recommends denylists that "block known malicious domains, URLs, and IP addresses." Apply DNS or web filtering to managed phones as well as laptops, so a scanned link from a work device goes through the same checks.

4. Bring phones into scope

If staff read work email on their phones, those phones are part of your email security. Require current operating system updates, as the FTC recommends, and a screen lock. Where you can, manage company phones so web filtering applies there too.

5. Protect your own domain

Quishing emails often claim to come from your IT team or a familiar service. DMARC, in the NCSC's words, "stops phishers from spoofing your domain," so criminals can't send from your exact address. It doesn't stop lookalike domains, which are covered in our guide to lookalike domain phishing. Check your policy with the DMARC Checker.

6. Investigate reported messages

When someone reports a quishing email, look at the headers to see where it really came from. The Email Header Analyzer runs in your browser, so nothing is uploaded. Then search for the same message in other mailboxes and remove it.

Quishing defense checklist

What if someone already scanned the code?

If they only looked at the page and closed it, report the message and move on. If they typed a password, approved an MFA prompt or entered payment details, act now: reset the password from a trusted device, revoke sessions, check for new MFA methods and inbox rules, and call the bank if card or account details were shared. Our guide on what to do after clicking a phishing link walks through each step for users and admins.

Next steps

1. Send staff the six rules above this week, with one real-looking QR code example.
2. Ask your email provider or filtering service how it handles QR codes in images and attachments, and write down the answer.
3. Move admins and finance staff to phishing-resistant MFA.
4. Run your domain through the free Email Health Check to confirm SPF, DKIM and DMARC are in place. If you want domain-level filtering in front of your existing mailboxes, see how iBlockSpam works.

Browse our other phishing and threat guides.