Quishing: How QR-Code Phishing Works (and How to Spot It)

QR codes went from pandemic-era convenience to universal interface in about three years. You scan them for menus, parking payments, EV chargers, conference check-ins, Wi-Fi passwords, banking logins, and a dozen other things a day. You barely think about it. That's exactly why attackers love them.

Quishing — short for QR-code phishing — is phishing with a QR code as the delivery mechanism instead of a clickable link. It's one of the fastest-growing attack patterns in 2026, and the reason is structural: a QR code is opaque to humans and to most email filters, so it slips past defences that would catch an ordinary phishing link in seconds.

Here's how quishing works, where it's showing up in 2026, and the habits that keep you out of it.

Why quishing beats old-school phishing defences

A traditional phishing email arrives with a visible URL — either as an inline link or hidden behind a button. Every major email provider scans those URLs, compares them against reputation lists, inspects their structure, and flags or quarantines suspicious ones. The defences are mature and effective.

A QR code short-circuits all of that. The URL is encoded into pixels. Email scanners either skip the image entirely or need specialised OCR-plus-QR-decoding pipelines to read it. Most current enterprise filters don't do this by default. So an attacker sending a phishing email whose call-to-action is a QR image sails through filters that would block the same URL posted as text.

Once the image reaches your inbox, the attack relies on two things:

• You'll scan the code on your phone, not your computer. Your phone has a smaller address bar and a harder-to-read URL preview, and you're probably doing it one-handed.
• You trust QR codes more than you trust links. Years of using QR codes for menus and payments have trained you to treat them as neutral infrastructure, the way you treat a doorbell or a lift button.

That combination — bypassed filters plus trusted-but-opaque delivery — is why quishing works.

The three dominant patterns in 2026

Pattern 1: QR-in-email (the corporate attack)

This is the corporate-crime-of-choice pattern and has been documented repeatedly by CISA and by enterprise incident response firms. It often arrives from a spoofed internal address and references a real process (quarterly review, document approval, multi-factor reset) to increase believability.

Pattern 2: Sticker overlays on physical infrastructure

Parking-meter quishing has been reported across Australia, the UK, the US, and much of Europe. In Brisbane and the Gold Coast, local councils have had to publish warnings after multiple reports of stickered meters in 2024 and 2025, and similar reports have come from FBI field offices in Texas and Florida. Charging-station quishing targets EV drivers paying through apps — the fake page captures both card details and sometimes the driver's charging-app credentials.

Pattern 3: Payment-redirect QRs

For more on the UPI variant specifically, see UPI Payment Scams in India. The general principle — read the payment preview carefully before authorising — applies to any payment-QR scenario globally.

What happens after you scan

Scanning a QR code doesn't do anything dangerous by itself. The QR is just a string, almost always a URL. The risk comes from what's at the other end, and the attacker's ideal outcome is one of:

• Credential harvest. A lookalike login page collects your username and password, often also a one-time code if the attacker is prepared to intercept it live.
• Malware download. On Android, a redirect to an .apk install. On iOS, a push for a configuration profile or TestFlight enrolment that routes traffic through attacker-controlled infrastructure.
• Unauthorised payment. A payment page that captures card details, or a payment-request QR that sends money from you.
• Identity data harvesting. A fake form that collects enough personal details (date of birth, passport number, address) to enable follow-on identity fraud.

The point of the QR is to get you to the page without the usual link-safety cues. Everything after that is standard phishing or malware distribution.

How to preview a QR safely

Use your phone's built-in preview

Both iOS Camera and Android Google Lens / default camera apps show the decoded URL before opening it. Read it. Look for:

• Does the domain match what you'd expect from the operator? A Linkt parking meter shouldn't link to linkt-au-pay-secure.com.
• Is it an IP address or a bit.ly-style shortener? Legitimate operators almost never use those in printed materials.
• Is there a suspicious path like /verify, /pay-now, or /update on an unfamiliar domain?

If the URL looks suspicious, don't tap.

Scan the QR with a dedicated scanner first

Our QR Scanner lets you upload a photo of a QR code (or a screenshot someone sent you) and see exactly what it encodes. The scanner then pushes the decoded URL through our URL safety pipeline — reputation, heuristics, and live probe — and tells you whether the destination is safe before you visit it.

This is the single most effective habit against quishing: never scan with the intent-to-follow camera when you're unsure. Scan with the decode-and-preview scanner first.

If you've already scanned

Most phones will show you the URL preview with an "Open in browser?" prompt. Close the prompt and then paste the URL into a scanner from your clipboard. If you've already tapped through, see What to Do If You Clicked a Suspicious Link for the response checklist.

For organisations: four quick controls

If you run IT or security for an organisation where users are getting quishing emails, four controls cover most of the attack surface:

1. Enable QR extraction in your email security. Major providers (Microsoft 365, Proofpoint, Mimecast) now offer QR-aware scanning. Turn it on.
2. Warn users about scan-from-phone prompts. Any email asking the user to scan a QR to complete a corporate action should be treated as suspicious by policy.
3. Run a test campaign. A QR-phishing simulation shows which users click through and informs training.
4. Harden mobile device access. If personal phones can reach corporate SSO, quishing becomes a one-step attack. Conditional access and device compliance narrow that path.

The one habit that matters most

Preview every QR code before you visit. That's it. Your phone's camera shows you the URL. Read it, don't just tap it. If the URL looks anything less than expected, upload the image to a QR scanner that checks the destination. It takes ten seconds and neutralises almost every quishing variant.

The QR code ecosystem isn't going to shrink — codes are genuinely useful, and they aren't going away. The defence isn't to stop scanning; it's to stop scanning blindly.