# Quishing

> Quishing is phishing delivered by QR code. It works because the destination is unreadable to a human before scanning, and because a code in an email image evades URL-based filtering that would catch the same link as text.

Source: https://useqr.app/glossary/quishing · Last reviewed 2026-08-21 · UseQR is free forever, MIT licensed, no signup.

---

## Why it is effective

1. **Nobody can read a URL from a pattern of squares.** Every other phishing channel gives
   the target something to inspect.
2. **It moves the victim to a phone**, which is usually outside corporate protection —
   no endpoint agent, no proxy, a truncated address bar.
3. **Email filters scan text, not images.** A QR code in an attachment or an inline image
   frequently passes filters that would have blocked the link.

## The common physical form

A sticker placed over a legitimate code — on a parking meter, a restaurant table, a
charging point, a payment standee. The attack requires no technical skill at all.

## Defences that work

- **Check the URL on the preview screen before opening.** Both iOS and Android show it.
- **Look at the code physically.** A sticker over a printed code has an edge you can feel.
- **Never scan a code that arrives in an unexpected email**, especially one claiming to be
  MFA re-enrolment.
- **Treat "scan to receive money" as a scam**, always. Payment codes initiate payments
  *from* the scanner.
- **For businesses:** print the payee name large, and check your standees daily.