# What is quishing (QR code phishing) and how do you stop it?

> Quishing hides a malicious link inside a QR code to slip past email filters and land the attack on your phone. Here is how quishing works and how to stop it.

Quishing is phishing that hides a malicious link inside a QR code instead of a clickable hyperlink. The victim scans the code — usually with a phone — and lands on a spoofed login page or a malware download. It works because a QR code is just an image, so text-based email filters cannot read the URL buried inside it, and the scan moves the attack onto a mobile device that sits outside your usual email defenses. The word is a blend of "QR" and "phishing," and it has become one of the faster-growing routes past email security.

## Quick takeaways

- Quishing = QR code phishing: the malicious URL lives inside an image, not a text link, so many email filters never see it.
- The attack deliberately shifts from the protected desktop inbox to a personal phone, where full URLs are hard to inspect.
- It is often paired with adversary-in-the-middle pages that steal session tokens and bypass multi-factor authentication.
- DMARC does not stop quishing — the QR image can ride on a message that authenticates perfectly, or come from an attacker-owned domain.
- The strongest defenses are phishing-resistant MFA, treating every QR code like an unknown link, and gateway filtering that inspects QR images.

## How does a quishing attack work?

An attacker builds a fake page — a cloned Microsoft 365 or Google Workspace login, a fake "review this document" portal, a bogus payment page — and encodes its URL as a QR code. That code is then dropped into a channel the target trusts: an email attachment or image, a PDF, a printed flyer or poster, a sticker placed over a legitimate code on a parking meter, or a direct message. The lure gives a reason to scan: "scan to view your voicemail," "scan to reset your MFA," "scan to confirm the invoice."

When the target scans, their phone opens the encoded link. Because the destination only appears after the scan — and mobile browsers truncate long URLs — the victim rarely sees the full, obviously suspicious address before the page loads. From there it is ordinary phishing: enter credentials, approve a prompt, or download a file.

The reason quishing spreads is structural. A QR code is an image, so a filter that scans message text for known-bad links has nothing to match against. The malicious URL is not in the body as text; it is rendered as pixels. That is the same detection gap that lets some [phishing pass SPF and DKIM](/learning/why-do-phishing-emails-pass-spf-and-dkim) — the security layer is looking in the wrong place.

## Why is quishing so effective at bypassing defenses?

It exploits three blind spots at once. First, **the image gap**: legacy, text-based email security cannot parse a URL hidden in a QR graphic, so the message often sails through to the inbox looking clean. Second, **the device switch**: scanning happens on a phone, frequently a personal one, that is not behind your corporate proxy, endpoint agent, or URL-rewriting filter — the controls that would catch the same link on a laptop are simply absent. Third, **the trust of physical context**: a QR sticker on a real poster or a code inside a well-formatted internal-looking email feels legitimate in a way a raw link does not.

Modern quishing rarely stops at stealing a password. Many campaigns route the victim through an adversary-in-the-middle (AiTM) proxy that relays the real login in real time, captures the resulting **session token**, and thereby bypasses multi-factor authentication — because a stolen live session does not need to re-prompt for MFA. In a [January 2026 advisory](https://www.ic3.gov/CSA/2026/260108.pdf), the FBI's Internet Crime Complaint Center reported that state-sponsored actors were embedding QR codes in spearphishing emails against think tanks, academic institutions, and government targets, with the attacks ending in session-token theft and MFA bypass. That pattern — QR lure, AiTM page, token theft — is the one to plan against.

## Can DMARC or email authentication stop quishing?

Not on its own. [DMARC](/learning/what-is-dmarc), SPF, and DKIM answer the question "did this mail really come from the domain in the From line?" They do not read the body, and they certainly do not decode QR images. A quishing email can:

- Come from an attacker-owned domain that publishes perfectly valid SPF, DKIM, and even a `p=reject` DMARC record — it authenticates cleanly because it genuinely is that domain.
- Ride on a compromised but legitimate mailbox, where the mail is authentically from a real, trusted sender.
- Arrive from a lookalike domain whose own authentication you have no control over.

In every case the authentication result is green or irrelevant, and the QR code passes through untouched. This is the same scope limit behind [does DMARC stop phishing](/learning/does-dmarc-stop-phishing): authentication proves *provenance*, not *safety*. DMARC's real job — closing exact-domain spoofing of your brand so attackers cannot forge *your* domain to phish others — remains essential, but it is a different problem from a QR code arriving in your team's inbox. Understanding that boundary is the difference between [phishing and spoofing](/learning/phishing-vs-spoofing-whats-the-difference).

## How do you stop quishing?

Because no single control catches it, quishing defense is layered across technology and habit:

- **Deploy phishing-resistant MFA.** FIDO2 security keys and passkeys are bound to the real domain, so an AiTM proxy on a lookalike page cannot complete the login even with a stolen password. This is the single highest-value control against token-theft quishing — see the [MFA types worth deploying](/learning/mfatypesformsp).
- **Use email security that inspects QR images.** Modern gateways decode QR codes in messages and attachments and evaluate the embedded URL, closing the image gap that text-only filters leave open. Check a suspicious destination with a [phishing link checker](/tools/phishing-link-checker) before you trust it.
- **Treat every QR code as an unknown link.** Preview the decoded URL before opening it, never scan a code that demands credentials or payment, and reach the service through its official app or a typed address instead of the code. This is core [social-engineering hygiene](/learning/common-social-engineering-attacks-protection).
- **Watch for physical tampering.** Stickers placed over legitimate codes on posters, parking meters, and mailers are a real vector; if a code looks added or overlaid, do not scan it.
- **Run realistic simulations.** Include QR lures in awareness testing so people meet the technique in a safe setting rather than a live attack.

DMARC still belongs in this stack — getting your own domains to enforcement stops attackers from *sending* quishing mail that forges your brand to your customers, which is exactly what Palisade automates: it deploys SPF, DKIM, and DMARC, moves your domains to `p=reject`, and reads the reports so exact-domain spoofing is closed. It will not decode a QR image in inbound mail, so pair it with gateway filtering and phishing-resistant MFA. Check where your domains stand with the [Email Security Score](/tools/email-security-score).

## Frequently asked questions

### Is quishing only an email problem?

No. QR codes reach people through printed posters, stickers, direct mail, messaging apps, and even physical objects. Email is a common delivery channel, but the defining trait is the QR code, not the medium — treat unexpected codes anywhere with the same caution.

### Does scanning a malicious QR code automatically infect my phone?

Usually not by itself — most quishing needs you to take a second action, like entering credentials or downloading and opening a file. The scan opens a page; the harm comes from what you do next. That said, never scan a code from an untrusted source.

### Why do attackers prefer QR codes over normal links?

Because a QR image evades text-based link filters, moves the victim to a less-defended phone, and borrows the trust of physical or well-formatted contexts. The link is also hidden until after the scan, so victims cannot inspect it in advance.

### How is quishing different from smishing?

Smishing is phishing delivered by SMS text message; quishing delivers the lure through a QR code. They can overlap — a text could contain a QR image — but the mechanisms and defenses differ, and neither is stopped by email authentication alone.

## Related reading

- [Does DMARC stop phishing?](/learning/does-dmarc-stop-phishing)
- [Why do phishing emails pass SPF and DKIM checks?](/learning/why-do-phishing-emails-pass-spf-and-dkim)
- [Phishing vs spoofing: what's the difference?](/learning/phishing-vs-spoofing-whats-the-difference)