Quishing: How to Spot and Stop Phishing with QR Codes

Since the pandemic, QR codes are everywhere: on menus, invoices, parcel slips and parking meters. Attackers exploit exactly that trust. To people, a QR code always looks the same. Where it leads only becomes visible after scanning.

How a quishing attack works

1. The lure: An email says that two-factor sign-in is expiring, a document needs signing or a payment is due.
2. The QR code: Instead of a link, the email contains a QR code, often as an image or in an attached document.
3. The switch to the phone: The recipient scans the code with their phone. That takes them out of the protected environment of their work computer.
4. The fake page: It looks like the Microsoft 365 sign-in, the bank or a delivery service and asks for login or payment details.
5. The access: The attacker signs in with the stolen data. Some pages also relay the two-factor confirmation in real time.

Why mail filters often miss quishing

• No link in the text: Many filters check links. At first, a QR code is just an image to them.
• Little text: Some messages consist almost entirely of an image with text and a code. Content filters find little to go on.
• Personal device: The click happens on the phone, which often lacks the company's web filters, warnings and logs.
• Small screen: Phones show the address shortened. A fake domain is easy to miss.

Common lures

• Renew two-factor sign-in: "Your MFA expires today. Scan the code to renew it."
• Approve a document: A supposed signature request or shared document with a QR code.
• Payslip or bonus: Messages in the name of the HR department.
• Parcel and payment: An unpaid customs fee or a delivery that is supposedly waiting.
• Fake stickers: QR codes stuck over the real ones on parking meters or charging stations, leading to fake payment pages.

Warning signs

• A QR code in an email you could just as well handle on your computer.
• Time pressure: "today", "immediately", "or your account will be locked".
• A reason that does not fit your processes, such as an MFA renewal by email.
• After scanning, an address that does not belong to the supposed company.
• A sign-in page reached through a QR code instead of the usual address.

How to protect your company

1. Read QR codes in the mail flow: A secure email gateway should detect QR codes in images and check the addresses inside like any other link.
2. Phishing-resistant sign-in: Passkeys or FIDO2 security keys cannot be used on fake pages. That takes away much of quishing's impact.
3. Clear rules: Decide and communicate that IT never asks for a sign-in or MFA renewal by QR code.
4. Secure smartphones: Work devices can receive web filtering and updates through mobile device management.
5. Train and practice: Show employees real examples. A phishing simulation can include QR code emails too.
6. Make reporting easy: A report button in the mail client gets suspicious messages to IT quickly.

Quishing and the SecTepe Mail Security Gateway

The phishing protection in the SecTepe Mail Security Gateway reads QR codes in image attachments and checks the addresses like any other link. Optical character recognition (OCR) also reads text sent as an image. If a message only stands out after delivery, the gateway pulls it back out of all mailboxes. The post Phishing Email in the Inbox? How to Pull It Back Everywhere explains how that works.

Conclusion

Quishing hides the phishing link in a QR code and moves the click to the smartphone, where company protection is often missing. What works is a combination: read QR codes in the mail flow, introduce phishing-resistant sign-in, communicate clear rules and practice regularly.