We spent two decades teaching people to hover over a link before clicking it. Then we started printing links as squares of black and white pixels that no human can read, and encouraged everyone to point a camera at them. Attackers noticed.
What happens
A QR code arrives in an email, a PDF, a poster in a car park, or a sticker placed over a genuine code on a parking meter. The pretext is always mundane: scan to view a secure document, scan to re-enable your multi-factor authentication, scan to pay, scan to see the menu.
Scanning opens a web page that looks exactly like a login screen you trust. You type your credentials. The page forwards them to the attacker, often in real time, so that they can log in while your session is still live — which also lets them relay a one-time code if you supply one.
Why this works better than a plain link
The clever part is not the QR code itself. It is the device switch.
- It skips your email security. A QR code is an image. Many filters that would have rewritten, sandboxed or blocked a suspicious URL never see one, because there is no URL in the message to inspect.
- It moves you to a phone. Your work laptop may have managed DNS, a web proxy and endpoint protection. Your personal phone has none of that. The attack deliberately steps off the protected device.
- Mobile hides the evidence. A phone browser shows a short, truncated address bar. The long, obviously-wrong domain that would have given it away on a desktop is simply not visible.
- Scanning feels like looking, not clicking. People who would never click a strange link will happily point a camera at a square, because it does not feel like a decision.
Physical codes count too. A sticker costs almost nothing. Codes on parking meters, restaurant tables, event posters and delivery lockers have all been overlaid with malicious replacements. Check whether the code looks stuck on top of something else.
Why it matters to you
Quishing targets exactly the gap in most awareness training. Staff are taught to be careful in email on a laptop. Nobody is taught to be careful with a camera. And because the final login page is on a personal device, an organisation often has no telemetry showing that anything happened at all — until the account starts sending its own phishing.
Red: the attacker's view
Cheap, fast and hard to attribute. The code can be regenerated endlessly, the landing domain rotated daily, and the lure printed on paper where no security product will ever scan it. Best of all, the victim performs the risky action on a device the defender cannot see.
Blue: what actually stops it
- Preview before you open. Most modern phone cameras show the destination address before loading it. Read it. If the domain is not the one you expected, stop. This one habit defeats most of these attacks.
- Never log in from a QR code. Make this a flat rule. If a code leads to a login page, close it and reach the service the way you normally do — your bookmark, your app, or by typing the address. No legitimate service is harmed by you logging in the usual way.
- Treat unexpected codes like unexpected links. Same instinct, same caution. An email with a QR code and an urgent tone is a phishing email that happens to use a picture.
- Use passkeys where you can. A passkey is bound to the real website's domain. On a lookalike domain it simply does not offer itself, so there is no credential to steal.
- Inspect physical codes. Peel-test the ones that ask for money. If a sticker lifts at the corner, do not scan it.
If you already entered credentials
- Change that password now, from a device you trust.
- Sign out of all sessions on the account.
- Review MFA methods and email forwarding rules for anything you did not add.
- If it was a work account, tell IT or security straight away — speed matters more than certainty.
Your one action this week: adopt the rule "I never sign in to anything I reached by scanning a code." Say it out loud to your team. It is simple enough to remember under pressure, which is exactly when you will need it.