Quishing: How QR Code Phishing Works, and How to Not Fall For It

For most of the last decade, QR codes were just a convenience — a fast way to load a restaurant menu, join a WiFi network, or check into an event. Attackers eventually noticed the exact quality that makes them convenient is also what makes them dangerous: nobody can read where a QR code leads by looking at the pattern. That blind spot has turned into one of the fastest-growing attack categories in security right now. Researchers tracking phishing trends reported a 146% jump in "quishing" incidents in the first quarter of 2026 alone, continuing a climb that's included reports of QR-related phishing rising several hundred percent since 2023.

The mechanism is simpler than it sounds, and understanding it is most of what you need to defend against it. Email security tools and spam filters are built to scan visible text and links for known-bad patterns. A QR code is just an image — the actual malicious URL encoded inside it is invisible to that scan. It only becomes readable once a phone's camera decodes it, and by that point you're usually holding a personal device, outside whatever security tooling protected the inbox the email arrived in. Quishing isn't exploiting a flaw in QR codes as a technology. It's exploiting a gap between where security tools look and where the actual link is hiding.

The realistic threat model here isn't a phone getting infected with malware the instant a code is scanned — that does happen, but it's the less common case. Far more often, scanning opens a convincing, professionally designed login page: a fake Microsoft 365 sign-in, a fake bank portal, a fake parcel-delivery tracking page asking you to "verify" a detail. The actual danger is what happens next — typing a real password or one-time code into that page — not the act of scanning itself. Some campaigns specifically target multi-factor authentication this way, since getting someone to type a live MFA code into a fake page is often easier than defeating MFA directly.

Quishing isn't confined to inboxes. A cheap, printed sticker with a malicious QR code pasted directly over a real one — on a parking meter, a restaurant table tent, an event poster — costs almost nothing to produce and looks identical to the original at a glance. Most people scan a code like that on reflex, the same low-friction way they'd tap a familiar app icon, without a second look at what they're about to load.

• "Your package couldn't be delivered — scan to reschedule"
• "Scan to verify your account" or "confirm your identity"
• "Scan to pay this parking fee" on a machine or meter
• "Scan for the menu" or "Scan for the WiFi password" at a table or counter

Most phones show a preview of the destination URL after scanning a code and before actually opening it. Read that line the moment it appears — the same instinct as hovering over a link before clicking — rather than tapping through on reflex. Look specifically for the real domain, not a close lookalike: an extra word, a swapped letter, or an unfamiliar top-level domain are the usual tells. If a code claims to be from a company or service you already know, it's often safer to navigate to that site directly from memory or a bookmark than to trust wherever the scanned link actually points.

“A QR code is a link with its address hidden until the last second — read that address the moment it appears, not after the page has already loaded.”

Not every QR code encodes its final destination directly. Many marketing-oriented QR generators create "dynamic" codes that actually encode a short redirect link controlled by that service — which means the destination the code points to can be changed at any time after the code is already printed and distributed, without the physical code itself ever changing. A "static" code, by contrast, encodes the real destination URL directly, and can never be silently repointed later. If you're generating a QR code yourself — for a business card, a flyer, an event — a straightforward static generator that encodes the actual link gives you a code that can't quietly change where it leads after the fact. When you're the one scanning a code, it's also worth remembering that even a legitimate-looking dynamic code today is only as trustworthy as whoever controls the redirect behind it tomorrow.

If a scanned code lands somewhere unexpected, or you're not fully confident a destination is legitimate before entering any information, running the URL through the Phishing / Lookalike URL Checker takes a few seconds and catches the lookalike-domain tricks that are easy to miss under a glance. And if you're the one putting QR codes out into the world — for an event, a menu, a business card — generating a plain, static code with the QR Code Generator means the link you're distributing is exactly the link you meant to distribute, with nothing that can be redirected later without your knowledge.