Quishing: QR Code Phishing, Explained

What quishing is

Quishing is phishing delivered by QR code. The attacker puts a malicious link inside a scannable square instead of writing it in an email, a text, or a chat message, and everything after the scan is ordinary phishing: a lookalike login page, a payment form that pays the wrong account, a "verify your account" screen that harvests card details.

The word is a contraction of QR and phishing, and it sits in the same family as the older terms.

That last row is the whole story. Phishing, smishing and vishing all hand the target something to evaluate before they act. Quishing does not.

Why a QR code is an unusually effective phishing vector

A human cannot read a QR code. You can look at paypa1-secure.com in an email and feel the hair stand up. You cannot look at a grid of black squares and feel anything, because there is nothing there to feel: the URL is encoded as a binary pattern with Reed-Solomon error correction interleaved through it. A single code holds up to 2,953 bytes, which is room for a URL far longer than the preview banner on your phone will show. The only way to know what a code contains is to decode it, and the default way to decode it is to open it.

That inverts the normal order of link safety. With a link you inspect, then click. With a code most people scan, then inspect, and by then the page has loaded, rendered, and asked for something.

QR codes in email get past filters that scan links

Mail security gateways are very good at URLs. They rewrite them, detonate them in a sandbox, check them against reputation feeds, and strip the ones that fail. Almost none of that machinery looks inside an image.

So the attacker puts the payload in a PNG: a fake "scan to re-enrol your MFA" notice, a spoofed invoice, a bogus document-signing prompt with a code in the middle. The message contains no clickable link at all, so link-based defenses have nothing to bite on. The mail lands, and the employee scans it with a personal phone, which is outside the corporate network, outside the managed browser, outside the endpoint agent, and outside the logging. That is why quishing shows up so often in corporate credential theft: it moves the click from a monitored device to an unmonitored one.

Placement does the persuading

A code on a parking meter inherits the meter's authority. A code on a restaurant table inherits the restaurant's. Physical context is a trust signal that costs an attacker the price of a sticker, and it works on people who would never click a strange link in an email.

The sticker-over-a-real-code attack

The most reported real-world quishing pattern involves no clever code at all. It is a printed sticker pasted over a genuine one.

• Parking meters and pay stations. The FBI published a public alert in 2022 about criminals tampering with QR codes to steal funds, and cities in the US and UK have repeated the warning since. The overlay sends the driver to a payment page that takes card details and starts no parking session, so the victim pays twice: once to the scammer, once in fines.
• Restaurant tables and menus. Table tents and loose laminated cards are the easiest targets there are, because the attacker can swap the whole card rather than cover it. The replacement looks like a menu, then asks for a card "to open a tab".
• Payment terminals and market stalls. Where QR payments are routine, a swapped code at the till routes the transfer to the scammer's account. The merchant finds out when the day's takings are counted.
• Posters, packages and letters. Fake missed-delivery notices, unpaid-toll letters and unordered parcels carrying a "scan to verify" code are direct-mail phishing that never touches an email filter.

The common thread is unattended, physical, and pointed at money or credentials. Nobody is watching a parking meter at 2 in the morning.

How to check a code before you open it

One sentence: decode first, decide second.

• Read the preview banner, and read the right part of it. iOS and Android show the destination before you tap. Check the registrable domain, the part immediately to the left of the .com or .de, not the reassuring words around it. account-verify.paypal.com.secure-login.ru is a Russian domain, not a PayPal one.
• Decode without opening. Photograph the code, then upload the picture to the in-browser QR scanner. It reads the image in your own browser and prints the full URL as text, so you can inspect it the way you would hover a link. This is the single most useful habit on this page.
• Treat a shortener on a payment or official demand as a failure. A real toll authority, tax office or bank does not route you through a generic short link. Shorteners have honest uses, covered in URL shorteners and QR codes, but not on an unsolicited request for money.
• Look for lookalikes. Digit-for-letter swaps like paypa1 and amaz0n, an extra hyphen, a brand name buried in a subdomain of something unrelated, a country code you had no reason to expect.
• Run a thumbnail over the physical code. A sticker on top of another sticker has a ridge. Bubbling edges, a code visibly newer than the sign it sits on, or a plain black-and-white square on an otherwise branded machine all mean use the venue's own app instead.

The wider consumer version of this check, including how counterfeit codes get distributed, is in fake QR codes, and the habit itself is walked through step by step in how to scan a QR code.

If you already scanned one

Scanning is rarely the damage. A QR code is encoded text and nothing more; it cannot install anything by itself, and the phone shows you the destination before it acts. The loss happens on the page that opens.

1. Entered nothing? Close the tab. That is the end of it. There is no infection to clean up.
2. Entered a password? Change it now, and change it everywhere you reused it. Turn on two-factor authentication on that account before anything else.
3. Entered card or bank details? Call the bank immediately and ask them to block the card and flag the transaction. Banks reverse far more fraud in the first hour than in the first week.
4. Installed something? Remove it, and on Android check Settings for any app you granted accessibility or device-admin rights to without meaning to.
5. Report it. Tell the venue, which usually has no idea its meter or table code was covered, and report the scam to your national fraud service.

Embarrassment costs people more money than the scam does. Speed is the one variable you control.

For businesses: protecting your own printed codes

If customers scan your codes, the sticker attack is aimed at your reputation, and the customer will blame you rather than the person with the glue stick.

• Make tampering visible. Print codes directly onto the menu, the sign or the machine, laminate them, or mount them behind acrylic. Loose table tents and adhesive labels are the easiest thing in the world to replace.
• Brand the code. A code in your colours with your logo in the centre cannot be overlaid invisibly, because a plain black square pasted on top looks instantly wrong to staff and regulars. Style yours with the custom QR code generator.
• Print the destination underneath. A human-readable domain under the square gives careful customers something to check against, and it costs you nothing.
• Walk them on a schedule. Put "scan every public code and confirm where it lands" on the weekly opening checklist. Five minutes beats a chargeback dispute.
• Use dynamic codes and watch the counts. Dynamic QR codes report scans per code, so a location that suddenly drops to zero is often a location someone has covered. Analytics turns tampering into an alert instead of a complaint three months later. Venues with a code on every table, such as restaurants, get the most out of that.

The trade-off is real and worth naming: dynamic codes give you the audit trail and the ability to repoint a printed code, but they depend on a redirect service staying alive, while a static code never expires and never reports a thing. Codes on money-handling surfaces are worth the dependency. A code on a poster in your own lobby probably is not.