What is quishing? QR code phishing explained

QR codes are everywhere — on restaurant tables, parking meters, delivery notices, and even in work emails. Most people scan them without a second thought. But that convenience is exactly what cyber criminals are counting on.

Quishing is a fast-growing type of cyberattack that uses QR codes to lure unsuspecting victims into handing over passwords, payment details, or personal data. So, let’s take a closer look at what quishing attacks look like and how you can protect yourself against them.

Quishing (QR Code Phishing) is a type of phishing attack where cybercriminals use QR codes that direct victims to fake websites or trick them into downloading malware. You may also see it referred to as QR code phishing, QR phishing, or simply QR code scams.

A QR (Quick Response) code is a two-dimensional barcode that can be scanned with a phone camera. It can store URLs and quick-links to payment instructions, contact info, Wi-Fi credentials, and more. It’s geniously convenient: point your phone, scan, and you’re there. But that same convenience is what makes QR scams so dangerous.

Unlike a regular link, a QR code hides its destination. The trust associated with QR codes and lack of a visible URL before scanning are exactly what cybercriminals exploit in quishing attacks — you can’t see where you’re going until you’ve already arrived.

But what are the attackers really after? Roughly 90% of quishing cases¹ aim to steal sensitive information, such as login credentials, credit card numbers, banking access, and personal details that can be used for identity theft. Some attacks also focus on installing malware for ongoing fraud.

Understanding how quishing attacks work helps you spot them before any damage is done. A typical quishing attack follows a clear sequence:

Quishing attacks often bypass traditional email security filters because the URL is embedded in an image rather than in clickable text. Most email security solutions scan for suspicious text-based links and known malicious domains, but they don’t decode QR codes inside images or PDF attachments by default.

Between June and September of 2024, Barracuda Networks found over half a million phishing emails containing QR codes hidden in PDFs. Among brands being impersonated in those quishing attacks, Microsoft accounts for 51% and DocuSign for 31%².

QR phishing comes in many forms, but the social engineering patterns repeat: urgency, fear, and convenience. Let’s see how attackers use QR codes in their schemes across both digital channels (emails, text messages, social media) and physical places (parking meters, restaurant tables, delivery notes).

Scammers use fake parking QR codes to steal payment information. The method is simple — criminals print QR stickers and place them over legitimate QR codes on pay-to-park kiosks or signs in busy areas.

For example, fraudulent QR code stickers were discovered on more than two dozen parking pay stations across Austin, Texas, with similar pay-to-park scams reported in San Antonio³. In the UK, the CFEU (Counter Fraud and Enforcement Unit) warns that scammers are placing fake QR codes on parking signs and machines to mimic legitimate payment platforms, such as PayByPhone, to steal banking details and commit identity theft⁴.

The FBI’s IC3 (Internet Crime Complaint Center) has also seen a rise in scammers using QR codes to direct victims to physical cryptocurrency ATMs to quickly complete payments for romance, lottery, and impersonation scams⁵.

Here’s what our Information Security Manager, Miguel Fornes, advises:

Delivery alerts often use QR codes to redirect to phishing sites. These arrive as door tags, flyers, or emails claiming a “missed delivery” from a well-known courier. Scanning the QR code leads to a fake portal demanding a small “redelivery fee” plus full card details.

The FBI also warns that criminals are now mailing unsolicited packages without sender information — a variation of a brushing scam — that contain QR codes prompting recipients to provide personal and financial data or unknowingly download malware⁶.

If you receive such a notice, go directly to the courier’s official app or website instead of scanning the attached QR code.

People receive quishing emails at work, often with fake invoices, payroll updates, or supplier payment confirmations that include a QR code “to view the secure document.” These codes lead to spoofed Microsoft or Google login pages designed for credential harvesting. Because the link is hidden within the image, these emails slip past many email security filters.

Fake QR codes can replace legitimate restaurant menu codes. Attackers place subtle sticker codes over the real ones on tables or posters. After scanning, you might be taken to a fraudulent menu site.

If a restaurant menu QR code asks for personal details, login credentials, or payment data, close the page immediately.

QR codes can impersonate account security warnings to steal data. These phishing emails or letters claim urgent account suspension or suspicious activity, then tell you to “verify your account by scanning this QR code,” which opens a spoofed login page.

Legitimate providers rarely require QR codes to fix account problems. Go directly to the official website or app by typing a known and trusted URL.

Quishing scams can affect anyone who scans QR codes, but some groups face a higher risk of falling victim:

Spotting a quishing attack requires noticing multiple clues around the QR code — urgency language, unknown sender, odd domain, and what happens right after you scan.

Be wary of QR codes that arrive unexpectedly via email, messaging apps, or printed flyers left on your car or mailbox. Indicators of a quishing attack include messages that urge immediate scanning. Legitimate organizations rarely send QR codes as the only way to resolve an issue or access their services.

Avoid scanning QR codes from an unknown sender, and if in doubt, contact the supposed sender through an official channel.

Attacks can involve physical tampering, where attackers place fake QR stickers over legitimate codes. Before you scan the QR code on any public sign or table, pay attention to:

Check for tampered QR codes before scanning — official venues typically have consistent branding and clear instructions next to legitimate QR codes.

Always check the URL preview shown by your phone after scanning before tapping open. Be cautious of QR codes in messages that create a sense of urgency or show:

If your browser or security software shows a warning, or anything feels off about the site, close the page instantly.

You don’t need to avoid QR codes entirely — just treat each one like an unknown link until proven otherwise. Most quishing attacks can be stopped by combining cautious habits with basic security tools:

Quick action limits damage. The most important step is to stop interacting with the suspicious site immediately. What you do next depends on how far the interaction went.

Simply visiting a phishing site without interacting is less dangerous, but stay alert.

Victims may be tricked into providing personal information after scanning, so acting fast is critical to prevent quishing attacks from escalating.

Quishing, phishing, smishing (SMS Phishing), and vishing (Voice Phishing) attacks share the same goal: to deceive victims into handing over data or money. Across all these scams, attackers frequently use crime spoofing — impersonating trusted brands, phone numbers, or email addresses — to make their messages convincing. However, they use different channels:

QR codes have become part of everyday life for payments, tickets, menus, and verification. They’re not going anywhere — and that means attackers will keep exploiting them. The good news is, you don’t need to avoid QR codes entirely. You just need to treat every QR code as an untrusted link by default, slow down, verify context before scanning, and use the security tools and practices you’ve learned in this article.