QR code phishing (quishing): why a square defeats your instincts

A QR code is a web address wrapped in an image. That is all it is — and that one property defeats a decade of security training in a single step.

"Check where the link goes before you click it" has been the central piece of phishing advice for years. A QR code makes it impossible. There is nothing to hover over and nothing to read. You point a camera at a square and trust it.

Attackers noticed. The Anti-Phishing Working Group reports criminals sending millions of emails each day containing QR codes that lead to phishing sites and malware.

Why it works so well

You cannot read it. A human cannot distinguish a code pointing at microsoft.com from one pointing at rnicrosoft-login.co. The visual channel carries no information at all.

Filters often cannot read it either. Security tooling that scans message text for suspicious URLs sees an image. Optical scanning is increasingly deployed but is far from universal.

It moves you to a less protected device. A QR code in an email on your work laptop gets scanned with your personal phone — which sits outside your employer's filtering, endpoint protection and monitoring entirely.

We were trained to trust them. Several years of menus, tickets, payments and check-ins established scanning as a normal, safe, routine act.

Where they appear

In email

The dominant pretext is authentication. "Your multi-factor authentication expires today — scan to re-enrol." "Scan to view your secure document." "Your mailbox password expires in 24 hours."

These work because re-enrolling a phone by QR code is a genuine, familiar procedure, so the fake version is indistinguishable in form from the real one.

On paper

Parking meters, restaurant tables, charging points, delivery cards, event posters, package inserts.

The physical attack is a sticker. Someone prints a code linking to their own payment page and places it over the legitimate one. It costs pennies, requires no technical skill, and the victim is standing in front of what appears to be official street furniture.

In physical mail

QR codes in letters that appear to be from a bank, a utility, or a tax authority. Physical mail carries a residual assumption of legitimacy that email lost long ago, which is precisely why it is being used.

How to scan safely

The defence is straightforward, and almost nobody uses it: every modern phone shows you the destination before opening it. iOS and Android both display a preview banner with the URL. Read it.

What to read for:

https://ezpass.toll-payments.co/pay
                 ^^^^^^^^^^^^^^^^^
                 the actual domain

The real domain is the part immediately before the first single slash. Everything to the left of it — ezpass here — is a subdomain chosen freely by whoever registered the domain, and carries no meaning whatsoever.

A five-step routine:

1. Scan, but do not tap through immediately.
2. Read the preview URL, and specifically the domain.
3. Ask whether it matches the organisation you believe you are dealing with.
4. Where money or a login follows, do not use the code at all — open the app or type the address.
5. For physical codes, check for a sticker before scanning. Run a finger over the edge.

What scanning actually risks

Scanning itself is harmless. A QR code contains text; your phone shows you where it points. The loss happens at the next stage — a credential entered on a fake login page, a payment made on a fake form, or an app installed from outside the official store.

Which means your existing defences still apply once you get there: passkeys will not present themselves to the wrong domain, and a password manager will not autofill on a lookalike. The code gets you to the door; those are what stop it opening.