QR code phishing, often called quishing, is risky because the QR code is an image, not a link. Your email provider and its link scanner can read a URL in a message, but they cannot reliably read the URL encoded inside a picture of a QR code. So a quishing email can pass through filters that would have blocked the same link written out in plain text. The destination is only revealed when you scan the code with a phone, which is usually outside the protection of your work laptop and its security software. If you receive a QR code in an email asking you to scan it, treat that as a warning sign rather than a convenience.
Why does a QR code slip past email security?
Most email security tools work by extracting text and links from a message and checking them against blocklists, reputation services and heuristics. A QR code is a grid of black and white squares. To a scanner it looks like an image attachment or an embedded picture. Some security products now include optical recognition that can decode QR codes in email, but coverage varies widely between providers and between consumer and business products. This is not a guarantee that any particular filter will or will not catch a given message. The practical point is simpler: a link hidden in an image is harder to inspect than a link written in the body text.
There is a second reason. Even when a scanner can decode the code, the scan happens at delivery time. Attackers can change what a QR code points to after the message has been delivered, for example by using a URL shortener or a redirect page they control. So a code that looked harmless when it arrived can lead somewhere else when you scan it an hour later. That is why the safest habit is to preview the destination yourself before you open it.
How does the quishing pattern usually work?
Quishing emails tend to follow a small number of familiar stories. The common thread is that they want you to move from a protected device, such as a work laptop with email filtering, to a personal phone where you are more likely to act quickly and less likely to have the same protections.
Multi-factor authentication reset
You receive a message that looks like it comes from your IT department or a software provider. It says your multi-factor authentication needs to be re-registered, or that a sign-in attempt was blocked and you must confirm it. A QR code is provided, and you are told to scan it with your phone to approve the sign-in or set up a new authenticator. In reality the code leads to a lookalike page that captures your password or tricks you into approving a real sign-in prompt. This pattern is effective because it borrows the language of security alerts, which people are trained to act on.
Parcel and delivery notices
A delivery message says a parcel is waiting, a fee is due, or an address needs confirming. The QR code is presented as the quick way to reschedule or pay. Fake delivery messages are one of the most common phishing themes, and the QR code version simply hides the link from the email scanner. Our guide to recognising fake parcel delivery emails and texts covers the wording and sender clues in more detail.
Parking, fines and permits
A message claims you have an unpaid parking charge, a congestion fee or a permit renewal. It includes a QR code to pay or appeal. These messages often arrive by email or are placed on physical signs, and the QR code leads to a payment page that collects card details. The pattern works because the amounts are small enough that people pay without checking closely.
Document and voicemail lures
A message says a document has been shared with you, or that you have a voicemail. The QR code is the way to open it. The page behind the code asks you to sign in with your email or work account, and the credentials are captured. This is a variation on the classic credential phishing page, with the QR code acting as the delivery mechanism.
What happens after you scan a malicious QR code?
Scanning the code itself does not install anything. The risk is in what the code opens and what you do next. The destination page may:
- Ask for your email password, work credentials or a one-time code, which the attacker then uses to sign in.
- Ask for card details for a small fee, which are then used for larger fraudulent purchases.
- Prompt you to install a profile, app or configuration file on your phone, which can give an attacker more control than a web page would.
- Trigger a real sign-in approval on your phone, which you confirm without realising you are approving an attacker's login.
If you have already entered credentials, change the password from a device you trust, revoke active sessions, and check your account recovery settings. If you entered card details, contact your bank. If you approved a sign-in prompt you did not initiate, report it to your IT or security team immediately. The steps after a credential leak are similar whether the lure was a QR code or a plain link, and our guide to spotting a phishing email covers the general signs to check.
How can you preview a QR code destination safely?
The goal is to see the URL before you open it, on a device where you can think clearly and where the page is not already trusted. There are a few practical ways to do this.
- Use your phone's camera preview. On many phones, pointing the camera at a QR code shows the decoded link as a tappable notification rather than opening it immediately. Read the domain before you tap. If the domain is unfamiliar, do not open it.
- Check the domain, not the whole URL. Attackers rely on long URLs with familiar words in the path. The part that matters is the registered domain just before the first single slash. A link that starts with a lookalike domain, or with an IP address, deserves suspicion.
- Use a QR scanner that shows the URL first. Some scanner apps and phone camera modes display the destination and require a second tap. Avoid scanners that open links automatically.
- Decode the image on a computer you trust. If the code arrived by email, you can save the image and decode it with a tool that shows the URL without visiting it. This keeps the link off your phone until you have inspected it.
- Never scan a code from an unexpected message. If you did not request a code, or the message creates urgency, treat the code as hostile until you have verified the request through a channel you chose, such as a phone number from the organisation's official website.
If you do need to open a link from a message, type the organisation's address yourself rather than following the code. For account-related messages, sign in through the service's own app or by typing its domain, not through a link in an email.
When is a QR code in an email legitimate?
QR codes are not inherently malicious. They appear in legitimate receipts, event tickets, invoices and some marketing messages. The difference is context. A code in a message you requested, from a sender you recognise, that leads to a domain you can verify, is lower risk. A code in an unexpected message that asks you to sign in, pay or approve something is high risk. The same rules that apply to links apply to codes: slow down, check the sender, and verify the destination independently.
If you are using a disposable inbox for a signup or a one-off transaction, remember that the same caution applies. A code sent to a temporary address is no safer than a code sent anywhere else. Our guide to how email verification codes get stolen explains why codes should never be forwarded or entered on a page you reached from an unsolicited message. If you need a throwaway address for a low-risk signup, a service such as MailboxTemp can receive the message, but it cannot tell you whether the sender is honest. You can read more about what a disposable address can and cannot protect in our article on whether temp mail is safe.
What should you do if you have already scanned a suspicious code?
Act quickly and in the right order. First, disconnect the phone from Wi-Fi if you installed anything, and remove any profile or app you did not intend to install. Second, change the password for any account you entered, starting with your email account, because it is usually the recovery route for everything else. Third, revoke active sessions and check for new forwarding rules or recovery addresses. Fourth, tell your bank if card details were entered. Fifth, report the message to your email provider and, if it was a work account, to your IT team. Keep the message so it can be examined.
If the code led to a page that asked for a one-time code, check whether that code was used to sign in somewhere. Many services show recent sign-in activity, and unusual locations or devices are worth investigating. The general recovery steps are similar to those after any phishing click.
Sources
- NIST, Digital Identity Guidelines: Authentication and Lifecycle Management (SP 800-63B) — guidance on authentication and why one-time codes and sign-in approvals need care.
- NIST, Digital Identity Guidelines: Enrollment and Identity Proofing (SP 800-63A) — background on how accounts are established and why verifying the request matters.
- IETF, RFC 3986: Uniform Resource Identifier (URI): Generic Syntax — the standard that defines how a URL is structured, including the authority and host components you check when previewing a destination.
- IETF, RFC 9309: Robots Exclusion Protocol — background on how automated clients read web resources, useful context for why link scanners see only what a page serves them.
In short
Quishing works because a QR code hides its destination from the tools that normally check links in email. The defence is to preview the URL before you open it, check the registered domain, and treat any unexpected code that asks you to sign in, pay or approve something as suspicious. If you have already scanned one, change passwords, revoke sessions and contact your bank or IT team as appropriate. A QR code is just a link in a picture; give it the same scrutiny you would give a link in text.