What Is Quishing? QR Code Phishing Attacks Explained

Quishing is a cyberattack that embeds malicious URLs inside QR code images in emails to bypass email security scanning. What is quishing in email security precisely? It is a phishing variant that sends victims to credential theft pages on their personal mobile devices, where no corporate security controls exist, because the dangerous URL is encoded inside an image that standard email gateways cannot read.

If your organization already has email security in place and still suffered a QR code phishing attack, the reason is not that your email security failed to block a link. Quishing never asks your email security to block a link at all. The QR code image is technically clean. The dangerous URL lives inside the image data. When an employee scans it with their personal phone, the attack moves completely outside every security control your organization has deployed.

What Is Quishing in Email Security?

Quishing combines QR code and phishing into a single term. It is a phishing attack that encodes a malicious URL inside a QR code image rather than presenting it as a clickable text link. QR codes arrive most commonly by email, though physical quishing attacks also use fake codes in car parks, on restaurant menus, and on office notice boards.

The growth trajectory has been significant. Abnormal Security reported a 587% increase in quishing attacks in 2023, making it one of the fastest-growing email threat categories documented that year. The FBI IC3 issued a public advisory on QR code fraud the same year, and the UK NCSC has published specific guidance on QR code phishing awareness for organizations.

What distinguishes quishing from standard phishing is the delivery mechanism. The malicious URL is not visible anywhere in the email. It is encoded inside an image file. Email security gateways that scan text URLs and HTML hyperlinks see only a QR code image with no text-based malicious content. For the broader phishing attack family, see Phishing vs Vishing vs Smishing: What Is the Difference?

How Does a Quishing Attack Work?

A quishing attack moves through a sequence that exploits the gap between inbox security and smartphone security.

The attacker sends an email containing a QR code image with a high-credibility pretext such as a Microsoft 365 MFA reset requirement, a password expiry notice, or an HR policy update requiring acknowledgment. Urgency language prompts the recipient to scan immediately rather than scrutinize the email.

The recipient scans the code with their smartphone camera. The encoded URL decodes and opens directly in the mobile browser, directing the victim to a convincing fake login page. When credentials are entered, they transmit immediately to attacker-controlled infrastructure. The victim is often redirected to the real site afterward, so no error message appears and the compromise is not immediately apparent.

The critical factor is the device transition. The victim’s work computer and email system never interact with the malicious URL. Every corporate security control on the work device is bypassed entirely because the attack completes on a personal smartphone outside the corporate security perimeter.

Why Are QR Code Phishing Attacks So Effective?

QR code phishing attacks succeed by exploiting three independent security gaps simultaneously. The combination makes quishing significantly harder to stop than standard phishing.

The most consequential gap that competitor content consistently underaddresses is the corporate-to-personal device boundary.

Most quishing analysis focuses on the email security bypass: QR codes encode URLs in image format that standard URL scanning tools cannot read. This is accurate but describes only one layer of the problem. Even if your email security gateway had perfect QR code scanning capability, the core vulnerability would remain: employees scanning QR codes with personal smartphones that have no corporate security controls installed at all.

A personal smartphone is not managed by your corporate MDM. It has no corporate endpoint detection running on it. It has no corporate DNS filtering. It connects to whatever mobile network or home WiFi the employee is using at the time. When the quishing URL opens on that device, no security tool in your organization can see, analyze, or block it.

This means quishing is as much a mobile security problem as it is an email security problem. Organizations that address quishing only by upgrading their email gateway close one gap while leaving the most consequential one open.

The pandemic context deepens the behavioral problem. QR codes became normalized during COVID-19 for menus, check-ins, and payment systems, training employees to scan codes without checking the destination first. Standard phishing awareness training teaches users to hover over links before clicking, but this habit does not transfer to QR code scanning. Quishing exploits exactly this gap between existing security training and the behavioral patterns employees carry from daily legitimate QR code use.

What Do Quishing Emails Look Like?

Quishing emails use professional-looking designs that closely mimic legitimate corporate communications. The QR code dominates the email layout as the primary call to action. The body contains limited text specifically to minimize the amount of content email security tools can analyze.

Pretext Type	Impersonated Brand/Sender	Call to Action	Red Flag Indicators
MFA Reset	Microsoft 365	Scan to re-verify authentication	Unexpected MFA request with no prior account change
Password Expiry	Microsoft/Google/IT helpdesk	Scan to renew password	Urgency, QR code as only option
HR Policy Review	Internal HR department	Scan to acknowledge updated policy	No text link alternative provided
Parcel Delivery	DHL/FedEx/Royal Mail/UPS	Scan to reschedule delivery	No order reference, unexpected notification
DocuSign Request	DocuSign/sender company	Scan to sign document	No prior conversation, immediate signature required
IT Security Alert	IT support/Microsoft	Scan immediately to protect account	Extreme urgency, no alternative contact method
Payroll/Benefits	HR/payroll provider	Scan to verify bank details	Financial data request via QR code only

How Does Quishing Bypass Email Security Tools?

Email security gateways scan text URLs and HTML href attributes but cannot extract URLs encoded inside QR code images without OCR or computer vision capability. Quishing emails contain no malicious code, no clickable links, and no suspicious attachments. They pass all standard technical email security checks at the email level because they are technically clean.

Criteria	Traditional Phishing	Quishing
Delivery Method	Malicious text URL or HTML link	QR code image embedded in email
Malicious Content in Email	Clickable malicious link	None detectable at email level
Bypasses Email URL Scanning	No, text URLs are scanned	Yes, URL inside image needs OCR to read
Attack Device	Corporate computer or managed device	Personal smartphone via QR scan
Corporate Security Coverage	Email gateway, endpoint, DNS filtering	No corporate controls on personal device
Detection Method	Hover over link to check URL	Preview URL in camera, check address bar
Primary Defence	Email URL scanning, phishing awareness	Email OCR scanning, mobile DNS filtering

The secondary bypass that most quishing content overlooks: mobile browser URL compression prevents post-scan domain verification even by security-aware users.

Employees trained to check the address bar after scanning face a specific disadvantage on mobile. Mobile browsers compress and truncate the full URL in the address bar more aggressively than desktop browsers. A quishing page using a lookalike domain such as microsoft-account-login.com may appear in the mobile address bar as “microsoft-account-log…” with the malicious part truncated. An employee checking whether the URL contains “microsoft” sees apparent confirmation while the dangerous portion of the domain is hidden.

URL shorteners inside QR codes create the same problem. When the encoded URL is a bit.ly or tinyurl link, the smartphone camera preview shows the shortener address rather than the final destination. Legitimate corporate communications almost never use URL shorteners inside QR codes, making their presence a reliable indicator of a quishing attempt.

For how to respond after visiting a phishing page on mobile, see What Happens If You Click a Phishing Link? What to Do Next.

How Do You Detect a Quishing Attack?

Detecting quishing requires different habits from standard phishing detection because the malicious element is an image rather than a visible link. Follow these steps whenever you receive an unexpected email containing a QR code.

Step 1: Check the sender email address and email context before scanning. Verify the sending domain carefully behind the display name, not just the name shown.

Step 2: Preview the URL in your smartphone camera before opening. Modern camera apps show the destination URL before launching the browser. Read it carefully before tapping.

Step 3: Verify the domain in the URL preview matches the claimed sender exactly. One extra word, hyphen, or different TLD indicates a lookalike domain.

Step 4: Be suspicious of URL shorteners in QR codes. Legitimate corporate communications do not embed shortened URLs inside QR codes. Report the email immediately if a shortener appears in the preview.

Step 5: Check the full browser address bar immediately after scanning before entering any information. Tap the address bar to expand the full URL if it appears truncated.

For physical QR codes in car parks or public spaces, look for raised edges or misalignment suggesting a sticker placed over an original code. For comprehensive phishing detection training, see Email Security Awareness Training: Building a Human Firewall.

What Are the Targets of QR Code Phishing Attacks?

QR code phishing attacks target the intersection of corporate account access and personal mobile device use. Microsoft 365 is the most commonly impersonated platform in quishing campaigns because of its corporate prevalence and the credible pretext that MFA updates create.

Primary corporate targets include:

• Finance and accounts payable teams: high-value payment authorization access makes credential theft immediately financially exploitable
• HR personnel: payroll system and employee data access provides both financial and intelligence value
• IT administrators: compromised admin credentials provide privileged access to corporate systems and cloud environments
• Remote workers: more likely to scan QR codes from work emails using personal devices when working away from the office

Physical quishing in car parks, restaurants, and public spaces targets entirely different victims: consumers’ personal banking credentials and payment card data rather than corporate accounts. Microsoft Security Intelligence has specifically documented quishing campaigns targeting Microsoft 365 credentials at scale across US and UK organizations.

How Do You Protect Against Quishing Attacks?

Protecting against quishing requires controls at the email level, the device level, and the awareness level. Technical controls alone are insufficient because the attack completes on personal devices that organizations often cannot directly manage.

Email level protection:

• Deploy email security with QR code OCR scanning capability to extract embedded URLs for analysis before delivery. Microsoft Defender for Office 365 and specialist email security vendors are implementing this. Evaluate whether your current gateway supports it
• Flag emails where a QR code is the only call to action with no text link alternative provided

Device and network level:

• Implement mobile device management to enforce security policies on devices accessing corporate resources, including URL filtering on managed mobile browsers
• Deploy mobile DNS filtering to block access to known malicious domains on personal devices employees use for QR scanning

Awareness level:

• Add quishing-specific scenarios to security awareness training. Standard phishing training does not address QR codes. See the Email Security Best Practices: The Definitive 2026 Checklist and Email Malware: Types, Delivery Methods and Protection Guide for the full email threat context
• Establish a QR code policy requiring verbal verification with the sender before scanning any unexpected QR code received by email

Cyber Security Solutions Ltd provides a free email security assessment that evaluates whether your current email gateway can detect QR code phishing attacks targeting your organization.

Conclusion

Quishing is a fast-growing attack category that simultaneously bypasses email security scanning, exploits QR code trust, and moves the attack to personal mobile devices outside all corporate security controls. Addressing it requires email OCR scanning capability, quishing-specific employee training, and mobile security controls that most organizations have not yet deployed. Visit cybersecuritysolutionsltd.com for a free email security assessment to find out whether your current controls can detect QR code phishing attacks before they reach your team.