# Quishing: QR code phishing explained

> Quishing is phishing delivered by QR code. It works for two structural reasons: a human cannot read a URL from a pattern before scanning it, and email filters that inspect text do not inspect codes inside images and attachments.

Source: https://useqr.app/docs/security/quishing-explained · Last reviewed 2026-08-21 · UseQR is free forever, MIT licensed, no signup.

---

## Why it works

**1. The destination is unreadable before you act.** Every other phishing channel shows the
victim something they can inspect. A QR code shows a pattern.

**2. It moves the victim to a personal device.** Phones are usually outside corporate
protection — no endpoint agent, no proxy, no URL rewriting — and the mobile browser truncates
the address bar, hiding the part of the domain that matters.

**3. Email security scans text, not pixels.** A QR code embedded in an image or a PDF
attachment routinely passes filters that would have blocked the same URL written out.

## The common campaigns

| Lure | Typical target |
|---|---|
| "Re-enrol your MFA" with a code in a PDF | Corporate credentials |
| "Your parcel could not be delivered" | Card details |
| Sticker on a parking meter | Payment card details |
| Sticker on a restaurant payment standee | Diverted payment |
| Sticker on an EV charger | Payment card details |
| "Review your payslip" | Payroll redirection |

The physical sticker attacks require no technical skill at all, which is why they are so
common.

## Defences for individuals

- **Read the preview banner** before opening. Check the domain immediately before the first
  single slash.
- **Never scan a code from an unexpected email**, especially about MFA, payroll or deliveries.
- **Feel for a sticker edge** on public payment codes.
- **Check the payee name** in your payment app against the printed business name.
- **Navigate manually** for anything involving credentials or money. Type the address you
  know.

## Defences for organisations

- **Include QR codes in phishing-awareness training.** Most programmes still only cover links
  and attachments.
- **Inspect images and attachments for codes** at the mail gateway — several security
  products now decode them.
- **Publish your real domains.** If customers know you only ever use `pay.example.com`, a
  fraudulent sticker is easier to spot.
- **Inspect physical codes on a schedule.** Payment standees, parking machines and public
  signage should be checked as part of a routine.
- **Print the payee name large** next to payment codes, so a substitution is visible on the
  confirmation screen.
- **Do not train customers to trust shorteners.** If your own material uses `bit.ly`, you
  have taught them that hidden destinations are normal.

## FAQ

### What is quishing?
Phishing delivered by QR code. The victim scans a code that leads to a credential-harvesting or payment page, instead of clicking a link.

### Why do email filters miss QR code phishing?
Traditional filters inspect text and URLs. A code inside an image or PDF attachment carries no text to inspect, so the message passes.

### How do I spot a malicious QR code sticker?
Feel the surface — a sticker applied over a printed code has a raised edge. On payment codes, check that the payee name shown in your app matches the business name printed on the sign.

### What should organisations do about quishing?
Add QR codes to phishing training, decode codes in images at the mail gateway, publish the only domains you use, and physically inspect public payment codes on a routine.

## Try it

- https://useqr.app/scan
- https://useqr.app/validate