QR code phishing: why a picture of a link is harder to check

QR code phishing - sometimes called quishing - replaces the link in a phishing email with a QR code. The code leads to the same place a phishing link would: a fake sign-in page, a fake payment form, or a page that tries to install something on the phone.

The US Federal Trade Commission warned about the technique in December 2023, describing QR codes sent by email and text with made-up reasons to scan them, and codes on public signs replaced with the scammer's own.

The core trick is moving the click off the protected device. A work laptop may have link rewriting, a managed browser and endpoint protection. A personal phone usually has none of those, and its small address bar makes a fake domain harder to spot.

• "Your multi-factor authentication needs to be re-enrolled - scan to keep access."
• "A document has been shared with you - scan to view."
• "Update your payroll or benefits details before the deadline."
• "Your mailbox password expires today."
• Parking, delivery or invoice notices that ask for a small payment.

Each one imitates something real. Companies genuinely use QR codes for MFA setup and for sharing, which is why the lure works.

A composite example. Names are fictional.

The sender domain is not the company's, the deadline is artificial, and real IT teams rarely ask staff to re-register MFA by scanning a code from an email. The code itself leads to a copy of the company's sign-in page that captures the password and the one-time code typed after it.

• A QR code in an email asking you to sign in, re-authenticate or "keep access".
• A sender domain that is not your company's, even if the name says IT or HR.
• A deadline and a threat - access locked, salary delayed.
• After scanning: a destination address that is not your company's real sign-in domain.

Many QR phishing pages are not simple copies of a login screen. They sit between the victim and the real sign-in page and pass everything through live:

1. 1The victim types their password into the fake page; it is forwarded instantly to the real one.
2. 2The real service sends a one-time code or push prompt, and the fake page asks for it.
3. 3The victim enters or approves it; the attacker's session is now signed in.
4. 4The attacker keeps the session cookie and often registers their own MFA method for later.

That is why six-digit codes and simple push approvals reduce the risk but do not remove it. Passkeys and hardware security keys are bound to the real website's domain, so they will not work on a fake page at all - the strongest single fix for this whole class of attack.

Tell staff one rule

IT will never ask you to sign in by scanning a QR code from an email. If you are unsure, open the site the way you normally do - bookmark or typed address - and sign in there.

Make stolen passwords less useful

• Turn on multi-factor authentication everywhere. Prefer number matching or passkeys, which are harder to relay through a fake page than six-digit codes.
• In Microsoft 365, Conditional Access can limit sign-ins to managed or compliant devices; Google Workspace offers context-aware access on some editions.
• Watch for new MFA methods registered on accounts - attackers add their own after a successful phish.

Before you scan anything

Most phone cameras show the decoded address before opening it. Read that address the same way you would read a link: who is the real owner of the domain?

A successful QR phish usually leaves traces in sign-in logs, even if nobody reports the email. Worth checking after any campaign that reached your company:

The pattern to watch for is a successful sign-in followed within minutes by a new MFA method or a new inbox rule. That sequence is how an attacker turns a captured password into lasting access.

QR codes in the office

If you use printed QR codes - Wi-Fi details, visitor sign-in, menus - check now and then that nobody has stuck a different code on top. Replaced codes on public signs and parking meters are among the cases the FTC has described.

1. 1If they entered a password: change it and sign out all sessions from a trusted device.
2. 2Review the account's registered MFA methods and remove any that are not theirs.
3. 3Check the mailbox for new forwarding and inbox rules.
4. 4If they paid: call the card issuer or bank's fraud line immediately.
5. 5Warn colleagues - the same message usually goes to many people at once.