# What it is
Quishing (QR-code phishing) is a social-engineering attack that replaces the clickable link in a traditional phishing message with a QR code. The victim scans the code with a phone camera and is taken to a website controlled by the attacker — typically a fake login page, a payment-fraud page, or a prompt to install an “app.”
The trick works because a QR code is unreadable to humans. With a normal link you can hover, inspect the domain, and decide. With a QR code there is nothing to inspect — you simply point and trust.
The QR code is not the weapon. It is the wrapping paper. It exists to hide a malicious destination and to move the victim onto a personal phone, where business security controls usually do not reach.
# How the attack works
- Lure. The attacker delivers a QR code — in an email (often as an image to dodge link scanners), a PDF invoice, a printed letter, or a sticker placed over a legitimate code in the physical world.
- Pretext. The surrounding message creates urgency or routine: “Scan to review your payslip,” “Scan to pay for parking,” “Scan to re-activate your account.”
- Scan. The victim uses a phone — outside the company firewall, often with no endpoint protection — and the encoded URL opens.
- Harvest. The destination is a convincing clone of a known brand or internal portal. The victim enters credentials, MFA codes or card details, which flow straight to the attacker.
- Pivot. Stolen credentials are used to access email, cloud apps or banking — often within minutes, before anyone notices.
# Real-world examples
Patterns that have repeatedly targeted organisations:
- Fake MFA “re-enrolment.” An email claiming the company is updating multi-factor authentication, with a QR code to “re-register your device.”
- Sticker overlays. Malicious QR stickers placed on parking meters, restaurant tables and EV chargers, redirecting payments to the attacker.
- Invoice and shipping lures. A PDF invoice or delivery notice with a QR code to “view” or “release” the item.
- HR and payroll bait. “Scan to view your updated benefits or bonus statement” — timed around payroll dates.
When the QR code is delivered as an image, there is no text URL for an email gateway to scan. The malicious link is, quite literally, a picture.
# How to detect it
Treat a QR code as suspicious when you notice any of these signals:
- An email’s main call to action is a QR code rather than a normal button or link.
- The message pushes urgency — accounts “expiring,” payments “failing,” access being “revoked.”
- You are asked to scan with a personal phone to do something work-related.
- The QR code arrives as an image attachment or sits inside a PDF.
- After scanning, the preview URL does not match the brand it claims to be.
- A printed or public QR code looks like a sticker applied over another code.
- The destination immediately asks for a password, MFA code or card number.
# How to defend against it
People
- Train staff that a QR code is an unreadable link — same caution as any link.
- Use a scanner that previews the full URL before opening it.
- Never enter credentials or payment details on a page reached from a scan.
- Verify unexpected requests through a known channel, not the message itself.
Technology & process
- Enforce phishing-resistant MFA so a stolen password alone is not enough.
- Use email security that can analyse QR codes inside images and PDFs.
- Protect mobile devices that touch company data with managed security.
- Give staff a fast, blame-free way to report a suspicious code.
# How Pendergrass Consulting helps
Pendergrass Consulting helps Research Triangle businesses close the quishing gap on both sides: the human and the technical. We run security awareness training (including QR-based phishing simulations), deploy email and endpoint protection that inspects QR payloads, and harden your MFA and identity setup so a single stolen password cannot open the door.