Malte ZanderContents
Quishing is phishing through a QR code. The code hides a link to a fake login, payment or verification page, and people scan it with a phone that company filters don't protect. Read the domain before you open a scanned link. As a brand, keep every code on your own domain and print that domain next to it.
- Security firm Mimecast found 655,673 unique malicious QR codes in the fourth quarter of 2025, 9% fewer than the 716,306 in the third quarter (APWG).
- Between October 2024 and March 2025, Mimecast counted more than 1.7 million unique malicious QR codes, and an average of 2.7 million emails a day carried QR codes (APWG).
- The US Federal Trade Commission warns of scammers covering QR codes on parking meters with their own, and of codes sent by text and email with invented reasons (FTC).
What is quishing?
Quishing, short for QR code phishing, replaces the clickable link with a QR code. The code leads to a page that imitates a real one, so that people enter credentials, card details or personal data. It can also lead to a malware download (FTC).
For a brand, the code is just the delivery. What waits behind it is the same fake login, payment or verification page as in any other brand impersonation case.
Why do criminals use QR codes?
Because a QR code removes the moment in which people would notice the fake:
The link is invisible. Nobody can hover over a printed square. The preview on a phone is small and often skipped.
The device changes. People scan with a private phone, outside the filters and protections of the company laptop that received the email.
An image is harder to inspect than text. A code inside an image or a PDF is less obvious to filters than a written link.
Habit helps the attacker. People scan codes for menus, parking, tickets and boarding passes every day (FTC).
Urgency does the rest. A failed delivery, a problem with the account or a forced password change push people to scan before they think.
Where do fake QR codes appear?
Wherever people already expect a code from you. That makes the list of your own QR touchpoints the best map of where fakes will show up.
| Where | Typical pretext | What waits behind the code |
|---|---|---|
| Email or PDF attachment | Confirm your account, sign a document | A copy of your login page |
| Letter or invoice | Settle an open amount, update bank details | A fake payment page in your name |
| Sticker over a real code on parking meters, posters or chargers | Pay here | A fake payment page |
| Text message or parcel notice | Reschedule a delivery | A fake tracking or payment page |
| Certificate or official document | Scan to verify | A fake verification page that confirms a forgery |
| Social media post or ad | Claim a prize or discount | A data collection or payment page |
The certificate case is especially hard to spot, because the forged document carries its own code to its own fake check. Our certificate fraud guide explains how these pages work.
How do you check a QR code before you trust it?
These steps work for your team and belong in your customer guidance:
Read the link in the preview before opening it. The domain is the part directly before the first single slash.
Read the domain from the right. In yourbrand.verify-login.com, the site belongs to verify-login.com, not to your brand.
Never log in or pay through a scanned link. Open the app or type the known address instead.
Ignore codes in unexpected emails and texts, especially urgent ones, and contact the company through a number or website you already know (FTC).
Check printed codes for stickers placed over the original.
Keep the phone updated and protect accounts with multi-factor authentication.
How do brands keep their own QR codes trustworthy?
You make your real codes easy to verify, so fakes stand out:
Use your own domain for every code. Anonymous link shorteners and third-party redirect services teach people to accept strange addresses.
Print the domain next to the code, for example: scan or type yourbrand.com/verify.
Keep landing and verification pages on your main domain, not on a new domain per campaign.
Never ask for credentials or payment data right after a scan, and say so in your communication.
Sign what the code confirms. For certificates, signed digital credentials can be verified independently of any web page. See verifiable credentials vs PDF certificates.
Give people a place to report a code that looks wrong.
What do you do when a fake QR code uses your name?
Decode the full URL, including parameters, and photograph or screenshot the code in its context.
Report the landing page to host, registrar and Google Safe Browsing. Our guide on reporting a phishing website lists every channel.
For printed codes, tell the location owner, such as the parking operator, and the police if payments were taken.
Warn customers with a picture of your real code design and the real domain. See how to warn customers without causing panic.
Watch for new domains that follow the same pattern.
Start the free fraud scan and get a short report on lookalike domains and copied pages within 48 hours.
FAQ
Is scanning a QR code dangerous in itself?
Scanning shows a link. The danger starts when you open it and enter data, approve a payment or install something. Read the domain before you open it.
Do email filters catch QR code phishing?
Not reliably. The link sits inside an image, and the person scans it with a phone that the company filter does not protect.
Are QR codes on certificates a security feature?
Only when they lead to a page people can trust. A forged certificate can carry its own code that leads to a fake verification page, so the domain behind the code matters more than the code.
What is the difference between quishing and smishing?
Smishing uses text messages, quishing uses QR codes. Both move the victim onto a phone, where links are harder to inspect.
Sources
APWG Phishing Activity Trends Report, Q4 2025, published 18 February 2026
APWG Phishing Activity Trends Report, Q1 2025, published 2 July 2025
FTC consumer alert: Scammers hide harmful links in QR codes to steal your information, 6 December 2023