Quishing is phishing that uses a QR code to deliver the malicious link. Because a QR code hides its destination until scanned, it bypasses the instinct to inspect a URL — and it moves the victim onto a phone, where checking is harder.

Where do malicious QR codes appear?

In emails and PDFs (to dodge link scanners), on stickers placed over legitimate codes in public, on fake parking or payment notices, and in posters or flyers. Anywhere a scan is expected, a fake code can be substituted.

How can brands reduce quishing risk?

Minimise reliance on raw QR codes for sensitive actions, use clear branded landing pages, and monitor for lookalike domains and cloned pages that QR campaigns point to — then take them down.

QR code phishing (quishing): the scan-and-steal scam

Quishing — QR code phishing — exploits a simple fact: a QR code hides where it goes until you scan it. That removes the one habit that protects people from bad links, inspecting the URL, and lands them on a phone where checking is hardest. It is phishing with the address bar switched off.

Why QR codes are a perfect disguise

Opaque by design — you can't read a QR code with your eyes, so you can't vet the destination first.
Scanner-evading — an image of a code in an email or PDF sails past link filters.
Mobile-first — scanning pushes you onto a phone, where lookalike domains and cloaking thrive.
Trusted context — codes feel official on posters, invoices and payment notices.

Common quishing tactics

Attackers email a QR code claiming you must "re-authenticate" an account; stick fake codes over real ones on parking meters or restaurant tables; or print them on convincing notices. In each case the scan leads to a fake login or payment page — often cloaked so it looks clean to any automated check.

A QR code is just a link you can't see. Treat the page it opens with the same suspicion as any link in a message — and be especially careful when it asks you to log in or pay.

What brands can do

Limit sensitive QR flows — avoid asking customers to log in or pay via a raw scanned code where you can.
Use clear, branded landing pages so a fake destination is easier to tell apart.
Monitor and take down the lookalike domains and cloned pages quishing campaigns rely on.

Phish Plug detects and removes the cloaked pages and lookalike domains that QR campaigns point to — cutting off quishing at the destination.

The takeaway

Quishing wins by hiding the link inside a code and moving you to a phone. The code itself is harmless; the page it opens is the threat. Be cautious with scans that ask you to log in or pay, and — as a brand — remove the pages those codes lead to.

QR code phishing (quishing): the scan-and-steal scam

Why QR codes are a perfect disguise

Common quishing tactics

What brands can do

The takeaway

Related articles

Pharming: when the right address sends you to a fake site

Malvertising: fake ads that impersonate your brand

How to spot a phishing email: the red flags that matter

Remove the clones targeting your brand