- A QR code is just a link you can't read until you scan it.
- Codes in emails and PDFs can slip past link scanners and move you to your phone.
- Always preview the address before opening, and be wary of any code that asks you to sign in or pay.
- For sites you already know, type the address yourself instead of scanning.
What quishing is
Quishing is phishing with a QR code instead of a clickable link. The code takes you to a fake page, usually a sign-in screen or a payment form, and anything you type goes straight to the attacker.
We've all got used to scanning codes for menus, parking and parcel tracking, so a code in an email or on a poster doesn't feel suspicious. That familiarity is exactly what makes it work.
Why attackers like it
It hides the link
Email security tools are good at checking links. A QR code is an image, often tucked inside a PDF attachment, so there may be no link in the email for them to check. And you can't hover over a picture to see where it goes.
It moves you to your phone
Your work laptop may have filters, warnings and a big screen that shows the full address. Your phone often has fewer protections, a small screen that cuts the address short, and it may be a personal device your IT setup can't see. The attacker has quietly moved you somewhere they're more likely to win.
It works off-screen too
Not all quishing arrives by email. Fraudsters stick their own QR codes over the real ones on parking meters, EV chargers and posters, leading to a lookalike payment page. Codes also turn up in letters and on fake delivery cards.
How to spot it
- Ask why it's a code at all. Your own IT team or a real supplier rarely needs you to scan a code from an email to sign in. That alone is a reason to pause.
- Preview the address before opening. Most phone cameras show the web address before you tap it. Read it.
acme-login.example-verify.cois not your company's sign-in page. - Check for stickers. On a meter or poster, look for a code stuck on top of another one, or one that's peeling or misaligned.
- Be wary of sign-in or payment pages. If a scanned code asks for a password or card details, stop and go to the site another way.
Habits for your team
The simplest rule is this: for anything you already use, type the address yourself or use the app or bookmark you already have. Your email, your bank, your accounting software and the council's parking app don't need a code to find.
Agree as a team that nobody will ever be asked to sign in by scanning a code from an email. Then if one turns up, it's obviously out of place. If someone does scan one and enters details, they should change the password from a trusted device, tell whoever handles IT, and forward the email to report@phishing.gov.uk.
Habits like these come from practice. Lureproof sends realistic practice emails to small teams on Google Workspace or Zoho, with a 60-second lesson for anyone who clicks. Our lure library shows the common patterns, and the free security training is open to everyone.
FAQ
What is quishing?
Quishing is phishing that uses a QR code instead of a clickable link. Scanning the code takes you to a fake page, usually a sign-in or payment form, on your phone.
Is it safe to scan QR codes at all?
Many QR codes are perfectly fine. The risk comes from unexpected codes, especially in emails, PDFs or stickers. Preview the address before opening it, and if a code asks you to sign in or pay, type the known address yourself instead.
What should I do if I scanned a suspicious QR code?
If you entered a password, change it from a trusted device and check MFA is on. If you entered card details, call your bank on the number on your card, or 159. Tell IT or your manager, and report the email to report@phishing.gov.uk.