What Is Quishing (QR Code Phishing)?

Quishing is phishing delivered through a QR code. The code hides the destination address, so the usual advice about checking a link before clicking does not apply, and the scan almost always happens on a phone that carries less protection than a laptop.

Phishing accounted for 16% of initial access in the 2026 Verizon Data Breach Investigations Report (p. 12). Quishing is that same pattern moved off the link and into an image no email filter can read.

For the attack patterns employees actually meet, see 10 real-life quishing examples.

What Is Quishing?

Quishing, from “QR code” and “phishing”, is a social engineering attack that delivers a malicious destination inside a QR code instead of a clickable link.

Three things make it different from email phishing:

• The destination is invisible. A link can be hovered over and read. A QR code cannot. The employee commits to the destination by scanning it.
• It travels as an image. Email gateways parse text and URLs. A QR code reaches the inbox as a picture, and most filters have nothing to read.
• It moves the attack to the phone. The scan happens on a personal or mobile device, usually outside the controls that protect a managed laptop.

What Is a Quishing Attack?

A quishing attack is any attempt that uses a QR code as the delivery method: a code in an email that claims an account needs re-verification, a sticker placed over a genuine code on a parking meter, or a code printed on an invoice that leads to a look-alike payment page.

The video below shows a quishing attempt as an employee would meet it.

How a Quishing Attack Works

1. The attacker generates a QR code that resolves to a page they control.
2. The code is placed where scanning already feels normal: an email, a poster, a menu, an invoice, a door sign.
3. The employee scans it, usually on a phone.
4. The destination is a look-alike login or payment page, or a file that installs malware.
5. Credentials or payment details are captured, and the attacker moves on to the account.

The important step is the third one. Every control an organisation has invested in sits on the laptop and in the mail gateway, and the attack has just stepped around both.

How Big Is Quishing in 2026?

Two measurements are worth holding side by side, because they count different things.

Microsoft Defender telemetry. QR phishing detections rose from 7.6 million in January 2026 to 18.7 million in March 2026, an increase of 146% in a single quarter (Microsoft, Email threat landscape: Q1 2026, 30 April 2026). This figure counts email threats detected and blocked by Microsoft Defender. It is not a global census.

APWG site counts. A quarter earlier, APWG recorded QR phishing volume down 9% quarter over quarter, with Walmart the most imitated brand at 61% of QR-based attacks (Anti-Phishing Working Group, Phishing Activity Trends Report, Q4 2025, pp. 8 and 9).

These do not contradict each other. One counts messages blocked in mailboxes, the other counts unique phishing sites observed. They should never be added together or compared directly. Read together, they say the technique is established and volatile rather than a passing spike.

The number that matters more to a security team is this one: 81% of organisations experienced at least one phishing, vishing or smishing incident in the past year (Gartner, Ditch Security Awareness and Adopt AI-Powered Secure Behavior Management, G00860839, September 2026, 2026 Gartner CISO Role Survey, n=297). Those organisations run awareness training. The channels they were hit on are often the ones the programme never tested.

Why QR Codes Get Past Email Filters

Link-based threats made up 78% of email threats in Microsoft's Q1 2026 telemetry (Microsoft, Email threat landscape: Q1 2026, 30 April 2026). Filters have had twenty years to get good at links.

A QR code is not a link to a filter. It is a block of pixels. Unless the gateway renders and decodes the image, there is nothing to reputation-check, nothing to rewrite, and nothing to detonate in a sandbox. Attackers also embed the code in a PDF or an image attachment, which adds another layer the scanner has to unwrap first.

Quishing vs Phishing vs Smishing

The pattern across the last three is the same: the attack leaves the channel that is monitored and lands on the device that is not.

Phone-based simulations fail at a rate roughly 40% above email simulations (Verizon, 2026 Data Breach Investigations Report, p. 50). An email-only programme has no measurement at all for the channels employees are least prepared for.

Where Employees Meet Quishing

Restaurant menus, parking meters, hotel WiFi notices, delivery notifications, charity appeals, property signs and invoices. The common thread is a situation where scanning already feels routine, which is what removes the hesitation.

Each pattern, with what to change, is set out in 10 real-life quishing examples.

The walkthrough below covers one of them end to end.

What Regulators Have Said

• FTC (January 2025). Warned consumers about unexpected packages containing QR codes that lead to phishing sites. FTC consumer alert
• FBI. Reported a rise in tampered and fraudulent QR codes redirecting to malicious sites.
• NCSC (UK). Published guidance on the growing use of QR codes in phishing and the limits of visual inspection. NCSC guidance
• Banks and regulators. Santander, HSBC, TSB and others have issued customer warnings on QR-based fraud.

For scale on the response side, the NCSC removed more than 1.2 million phishing campaigns through its Takedown Service, half of them within an hour (NCSC, Annual Review 2025).

How to Spot a Malicious QR Code

• Check whether a physical code is a sticker. A code placed over another one is the single most common physical tactic.
• Preview the address before opening it. Most phone cameras show the destination before loading it. Read it.
• Treat any code that leads to a login or payment page as suspicious. Legitimate services rarely need a QR code to reach a sign-in screen.
• Be alert to urgency. “Scan to verify your account” and “act within 24 hours” are the same pressure used in email phishing.
• Notice context that does not fit. A QR code in an unexpected email, on an invoice that arrived early, or on a sign that looks freshly printed.

Static and Dynamic Codes

A static code holds a fixed destination, so changing it means physically altering the printed code. A dynamic code holds a short URL that the creator can repoint at any time, which means the destination can change after the code is printed and nothing visible changes.

Dynamic codes are convenient, and that is the risk: the code an employee trusted last month can lead somewhere else today.

How to Prevent Quishing

Controls

• Mobile device management on the devices that scan work-related codes
• Conditional access and phishing-resistant MFA, so captured credentials are not enough on their own
• Email gateway settings that render and decode images where the platform supports it
• A physical inspection routine for printed codes on company premises

Behaviour

• A reporting path that covers more than email. Keepnet's report button covers three channels: email through the Outlook and Gmail button, and SMS and calls through the Keepnet SMS and Call Reporter app.
• Short, in-the-moment guidance at the point of risk rather than an annual course
• Follow-up aimed at behaviour, never framed as a failure

Speed of reporting decides the outcome more often than speed of detection. An employee who reports a scan within minutes gives the security team a window that a weekly report does not.

How to Test Employees Against Quishing

You cannot measure a channel you never simulate. Run QR code simulations alongside email, SMS and voice so susceptibility is comparable across channels rather than guessed.

Across Keepnet customer data, 9.2% of employees clicked their first simulation, falling to an average of 4.8% across the simulations that followed.^[1]

Keepnet's Quishing Simulator runs QR code scenarios against your own employees and reports susceptibility by department, so the channel stops being a blind spot. Every Keepnet product can be bought on its own, without the training library.