# 10 Real-Life Quishing Attack Examples Source: https://keepnetlabs.com/blog/10-real-life-quishing-attack-examples-to-strengthen-your-cybersecurity Published: 2024-11-15 Updated: 2026-10-15 Author: Ozan Ucar, Founder and CEO of Keepnet Category: Social Engineering > Ten quishing patterns employees meet, from restaurant menus to MFA re-enrolment emails, each with what the employee sees and what to change. QR codes now sit on menus, parking meters, invoices and door signs, and attackers have followed them there. Microsoft blocked 7.6 million QR phishing attempts in January 2026 and 18.7 million in March, an increase of 146% in one quarter (Microsoft, Email threat landscape: Q1 2026, 30 April 2026; email threats detected by Microsoft Defender, not a global census). For how the attack works and why email filters miss it, see [what is quishing](https://keepnetlabs.com/blog/understanding-quishing). Below are ten QR code phishing examples employees meet, each with what the employee sees and what to change. ## 1. Restaurant Menu QR Codes A sticker goes over the genuine menu code. The diner scans it expecting a menu and lands on a page asking for a card to confirm the table. **What the employee sees**: a code that looks slightly fresher than the laminate around it. **What to change**: staff check table codes at open and close. A code that leads to payment before food is a stop sign. ## 2. Parking Meter Payment Codes The highest-volume physical pattern, because paying by code at a meter is already normal and the driver is usually in a hurry. The fake code leads to a payment page that captures card details and never reaches the council. **What the employee sees**: a code on a sticker, often slightly crooked, over the printed one. **What to change**: pay through the operator's own app rather than a code on the machine. For fleet and field teams, make that the standing instruction. Keepnet walks through this pattern in the video below. ***Editor's Note: This article was updated on March 12, 2026***. Video: ## 3. MFA Re-enrolment Emails The corporate pattern, and the one that costs the most. An email that appears to come from IT says multi-factor authentication needs re-enrolling and includes a QR code to scan. The code resolves to a look-alike sign-in page on the employee's phone, outside the controls on their laptop. **What the employee sees**: a routine IT request, in the right template, at a plausible moment. **What to change**: state plainly that IT never asks employees to enrol MFA by scanning a code from an email. One sentence in onboarding removes most of this. ## 4. Airline Boarding Pass and Check-in Codes Contactless boarding made the scan routine. Fake codes appear on check-in signage and in confirmation emails, leading to pages that harvest passport and payment details. **What the employee sees**: a code at the moment they are most distracted and least likely to pause. **What to change**: travel policy names the airline app as the only check-in route for business travel. The next video shows how quickly this one runs. Video: ## 5. Charity and Donation Appeals Fake codes on donation boxes, collection signs and appeal emails lead to look-alike donation pages. The amount is small, which is exactly why nobody checks. **What the employee sees**: a cause they recognise and a code that asks for card details. **What to change**: for workplace fundraising, publish the destination URL next to the code so there is something to compare against. ## 6. Cryptocurrency and Investment Codes A code claims to link to a wallet or an exchange and resolves to a look-alike site that captures seed phrases or redirects a transfer. Irreversible by design, which makes it attractive. **What the employee sees**: a code shared in a group, a webinar slide, or a social post. **What to change**: treat any code that leads to a wallet or a transfer as hostile until verified through a second channel. Video: ## 7. Social Media Promotions and Giveaways A code promises a contest entry or a discount and leads to a page that captures login details for the platform itself, which is then used to spread the same scam from a trusted account. **What the employee sees**: a giveaway from an account that looks established. **What to change**: this one reaches corporate accounts through marketing teams. Anyone with access to a brand account should treat codes in direct messages as hostile. ## 8. Hotel WiFi and In-room Service Codes Codes on welcome cards and in-room folders are replaced or added. The guest scans for WiFi and reaches a captive portal that asks for a work email and password. **What the employee sees**: a WiFi login that asks for more than a room number. **What to change**: business travellers use a phone hotspot rather than guest WiFi. A captive portal should never need a corporate password. The video below shows the captive portal version. Video: ## 9. Property Listings and For Sale Signs Codes added to boards and listings lead to pages that capture contact and financial details under the cover of a viewing request or a mortgage pre-check. **What the employee sees**: a code on a sign that has been outside for weeks. **What to change**: agents photograph their own codes at installation so a replacement is visible on the next visit. ## 10. Invoices, Statements and Payment Requests The pattern with the largest single loss. A code on an invoice or a statement leads to a payment page that mimics the supplier's. The money leaves through a legitimate-looking process. **What the employee sees**: an invoice that arrives when an invoice was expected. **What to change**: finance confirms any change to payment details by calling a number already on file, never a number or code in the document itself. Video: ## What These Ten Have in Common Three things, every time: - **Scanning already felt normal**. None of these asks the employee to do something unusual. - **The destination was invisible**. There was nothing to hover over and read. - **The phone was the weak point**. The scan happened on the device with the fewest controls. Regulators have flagged several of these directly. The FTC warned about QR codes arriving in unsolicited packages ([consumer alert, January 2025](https://consumer.ftc.gov/consumer-alerts/2025/01/got-package-you-didnt-order-its-probably-scam)), and the NCSC has published guidance on the limits of inspecting a code by eye ([NCSC](https://www.ncsc.gov.uk/blog-post/qr-codes-whats-real-risk)). ## Why Awareness Training Alone Does Not Close This 81% of organisations experienced at least one phishing, vishing or smishing incident in the past year (Gartner, Ditch Security Awareness and Adopt AI-Powered Secure Behavior Management, G00860839, September 2026, 2026 Gartner CISO Role Survey, n=297). Those organisations run training. The gap is measurement. Phone-based simulations fail at a rate roughly 40% above email simulations (Verizon, 2026 Data Breach Investigations Report, p. 50), and an email-only programme produces no number at all for the channels in this article. Across Keepnet customer data, 9.2% of employees clicked their first simulation, falling to an average of 4.8% across the simulations that followed. *Source: Keepnet anonymised customer research, email phishing simulations delivered 1 January 2020 to 29 September 2026, employees who received at least 12 simulations (n=102,452 employees across 158 organisations). Methodology: doc.keepnetlabs.com/resources/research-methodology*. ## Test Your Employees Against These Patterns [Keepnet's Quishing Simulator](https://keepnetlabs.com/products/quishing-simulator) builds QR code scenarios from the patterns above and reports susceptibility by department, alongside email, SMS and voice simulations so the channels stay comparable. Employees report what they spot through Keepnet's report button, which covers three channels: email through the Outlook and Gmail button, and SMS and calls through the Keepnet SMS and Call Reporter app. Every Keepnet product can be bought on its own, without the training library. [Book a demo](https://keepnetlabs.com/get-demo). Video: ## Frequently Asked Questions ### What is an example of QR code phishing? A sticker placed over the genuine code on a parking meter, sending the driver to a payment page that captures card details. The ten patterns on this page cover the physical and the email versions. ### What are the most common quishing examples? Parking meters and restaurant menus on the physical side, and MFA re-enrolment or shared-file emails on the digital side. Invoice and payment-request codes produce the largest single losses. ### What does a quishing email look like? Usually routine. An IT message saying multi-factor authentication needs re-enrolling, a shared-file notice, or a delivery update, each with a QR code and a reason to scan it on a phone rather than open it on the laptop. ### Where do quishing attacks appear? Restaurant menus, parking meters, hotel WiFi notices, charity appeals, property signs, invoices, delivery notifications and internal IT emails. The common thread is a situation where scanning already feels routine. ### Which quishing pattern costs organisations the most? Invoice and payment-request codes, because the loss is a completed transfer rather than a credential, and MFA re-enrolment emails, because one captured sign-in opens the account. ### How can you tell a QR code is malicious? Check whether a physical code is a sticker placed over another one, preview the address before opening it, and treat any code that leads to a login or payment page as suspicious. ### What should an employee do after scanning a malicious code? Report it immediately and enter nothing. If details were already entered, change the password from a different device and tell the security team, because speed of reporting decides the outcome. ### How do you test employees against quishing? Run QR code simulations alongside email, SMS and voice so susceptibility is comparable across channels. For how the attack works, see [what is quishing](https://keepnetlabs.com/blog/understanding-quishing).