QR Code Phishing (Quishing)

Layer 8: People Medium risk

How it works

QR codes are now familiar from menus, parking meters and event check-ins, so people scan them without much thought. In QR code phishing, an email might claim you must scan a code to set up multi-factor authentication, review a document or confirm a payroll change. Physical versions involve stickers placed over legitimate codes on signs or parking machines. Printed codes in letters and invoices that appear to come from banks, utilities or government agencies are also used.

Because the link is inside an image, some email security tools do not inspect it, and the scan happens on a personal phone that may lack company protections. The phone's small screen also makes it harder to check the web address. The destination is typically a fake login page or payment form designed to capture credentials or card details. Personal phones are also less likely to be covered by company monitoring, so the compromise may go unnoticed for some time.

Warning signs

• Emails asking you to scan a code to sign in or verify
• QR stickers placed over existing signs or codes
• Codes leading to login or payment pages
• Web addresses that do not match the expected organization
• Urgency about account suspension or payroll changes

How to defend against it

• Use email security that analyses images and QR codes
• Teach staff that legitimate sign-ins rarely require scanning a code from email
• Check the previewed address before opening a scanned link
• Protect company phones with mobile threat defence
• Use phishing-resistant MFA

If it happens to you

1. Close the page and do not enter any more information
2. Change any credentials entered and notify IT
3. Contact your bank if card details were provided
4. Report tampered physical codes to the property owner