QR Code Phishing: When the Link Hides Inside a Picture
QR code phishing, or quishing, hides a malicious link inside a picture, so link checks can miss it and the victim scans it on a phone.
4 min readBeginner Oct 28, 2026
Explain Like I'm Not a Hacker
A QR code is a sealed envelope with the address written in a code only your phone can read. You find out where it leads after you have already opened it.
The 30-second explanation
A QR code is a link drawn as a picture, and phishers have noticed. They put one in an email, a PDF, a poster or a sticker and ask you to scan it to verify an account or pay a bill. Many email filters are built to inspect links in text, and a link that exists only as an image is harder for them to read. Scanning also moves you to your phone, which usually has fewer protections than a work laptop, and the small preview hides the real address.
How it works
- 1
1. Bait
The code arrives in an email, PDF, text, poster or sticker over a real code, with a reason to scan it: a parcel, a payment, an account check.
- 2
2. Scan
The victim scans it with a phone, often a personal device outside the company's email and web filtering.
- 3
3. Landing page
The phone opens a cloned sign-in or payment page, sometimes after redirects that hide where it ends up.
- 4
4. Capture
Credentials, card details or an MFA code typed into the page go straight to the attacker.
A QR code is a link drawn as a picture, and that is the whole trick. Email security tools are good at reading links in the text of a message and checking them against lists of bad sites. A link that exists only as pixels is harder to read, and some filters never look. The scan then helps the attacker a second time. It moves the victim to a phone, often a personal one, which sits outside the company's web filtering and security agent. The phone's preview shows a short, cropped address that is easy to miss. The page behind the code is usually a clone of a sign-in or payment screen, sometimes reached through several redirects so the final address keeps changing. The codes also turn up in the physical world, where a sticker placed over a real code on a parking machine or a poster sends people to the attacker's page instead. The defences are the habits that work against any phishing, applied to a code: check where it leads before opening it, and go to the real site directly for anything involving an account or money.
Real-world example
An employee gets an email that looks like an IT notice: scan this code to keep your multi-factor authentication active. There is no link in it, only a picture of a code. At their desk they scan it with a phone, and it opens a page that looks like the company sign-in. They type their password and the one-time code. The whole thing took five seconds and happened entirely outside the laptop's protections.
How to spot it
A code where a link would normally be
An email whose only content is a picture of a code, especially one pushing urgency about MFA, payroll or a delivery.
A code you did not expect
A sticker placed over a printed code, or a message from a service that has never used QR codes with you before.
A preview address that looks wrong
The address your phone shows before opening is a different domain, a link shortener, or a string of random characters.
A sign-in request right after the scan
A normal code opens a page or a menu. One that immediately asks for a password, card number or code is a warning sign.
What to do
- 1Treat a QR code like any unknown link: read the address your phone shows before opening it, and skip codes from unexpected emails or messages.
- 2For anything involving your account, close the message and go to the site or app directly, using a bookmark or by typing the address.
- 3Organisations should scan images for QR codes in email security and include them in phishing training. Report any code you suspect, even if you did not scan it.
Stay curious. Stay safer.
This is one piece of a bigger picture. Explore more real-world examples, concepts and tips to build your cybersecurity awareness.