Category hub: Social engineering and human risk

In one sentence: Quishing is a phishing scam that hides a dangerous web link inside a QR code, so the victim scans it with their phone instead of clicking a link.

What is quishing (QR code phishing)?

A QR code is a square picture that holds a web address. Scanning it opens that address. Quishing uses that picture in place of a normal link in a phishing email, or on a sticker placed over a real code.

The NCSC says QR codes are increasingly being used in phishing emails, a technique sometimes called quishing. It also says that most QR codes you meet in pubs and restaurants are probably safe to scan, and that QR-enabled fraud is small compared with other types of cyber fraud.

How it works

1. The attacker puts a QR code in an email, a document or a physical sticker.
2. The NCSC explains why this helps them. People are wary of dodgy links, and not all security tools that detect phishing emails scan images, so a QR code can slip through.
3. The victim scans the code with a personal phone. The NCSC notes personal devices may not have the same protections as a work computer.
4. The phone opens a fake page, often a sign-in or payment page. The attacker collects whatever is typed in.

Who it affects and how badly

• Sole trader to 10 staff: staff may scan codes on personal phones. One scanned code can hand over a Microsoft 365 or banking login.
• 10 to 50 staff (retail, hospitality, trades): QR codes on menus, invoices and parking or payment points are everyday items, so fake stickers are plausible. Worst case is a stolen card or account.
• 250 plus and regulated firms: a stolen work login can open a mailbox holding personal data, which may be reportable to the ICO.

Real examples

The NCSC blog notes that reports of QR-enabled fraud in the UK can be found online, including a BBC News report of a woman scammed at a railway station: NCSC blog. No named organisation with a primary-source incident has been added here.

How to detect it

• Ask staff to report emails whose main content is a QR code, especially “scan to verify” or “scan to sign in” messages.
• Check whether your email filtering inspects images. Ask your provider.
• Look at sign-in logs for logins from new places shortly after a staff member reports scanning something.
• Check physical codes for stickers placed over the original.

How to fix or prevent it

1. Do not scan QR codes in unexpected emails. Type the address or use a saved bookmark instead.
2. Use the scanner built into the phone camera rather than a downloaded app, as the NCSC recommends.
3. Read the web address your phone shows before opening it.
4. Turn on multi-factor authentication so a stolen password is not enough.
5. Take extra care with codes in open public places, as the NCSC advises.
6. Include QR code lures in awareness tests. Microsoft Defender for Office 365 Plan 2 supports QR code payloads in its Attack simulation training.

Related terms

• phishing
• smishing
• vishing
• phishing-simulation
• multi-factor-authentication
• social-engineering

Frequently asked questions

What is quishing?
It is a phishing scam that hides a dangerous web link inside a QR code, so the victim scans it with their phone instead of clicking a link.

Why does quishing slip past security tools?
The NCSC notes that not all security tools that detect phishing emails scan images, so a QR code can get through.

How can I stay safe from QR code phishing?
Do not scan codes in unexpected emails, use the phone camera’s built-in scanner, read the address before opening it and turn on multi-factor authentication.

How Wolfcore helps

Phishy runs realistic phishing simulations against your own staff and shows you who clicked, so you can train the people attackers target. See Phishy phishing simulation.

Service page: Phishy phishing simulation.