What is happening here
Quishing is phishing delivered through a QR code. Instead of a clickable link that email filters can inspect, the attacker hides the destination inside a QR image, and the victim supplies the missing step by scanning it with a phone.
Quishing usually arrives as an email, a message, or a printed notice urging quick action: verify an account, release a parcel, or confirm a payment. The QR image sits where a link would normally be, which lets it slip past link scanners that only read plain text.
Red flags to check before you scan
- The message creates urgency: an account closure, a missed delivery, or a payment hold that needs action now.
- The sender is unfamiliar, or the message arrives outside any conversation you were already having.
- The notice asks you to scan rather than offering a typed web address you can check.
- The QR image is embedded in an email or PDF instead of appearing on an official page you navigated to yourself.
- The wording asks for sign-in, payment, or personal details right after the scan.
Verify before you trust it
1. Pause and treat the message as unproven, however urgent it sounds.
2. Go to the organisation through an address you already trust, such as a bookmark or the official app, and check for the same alert there.
3. If the QR is printed on paper, look for signs it was added later, such as a sticker edge or a mismatch with the rest of the document.
4. Ask the sender through a separate, known channel whether they sent it before you scan.
Putting this into practice
Build a habit you can use in seconds. Pause before every unexpected scan, read the destination preview, and check the domain against what you already know. If the code is printed in public, look for sticker edges and compare it with nearby signs. If the code arrived in a message, verify it through a separate channel you trust. The pause costs almost nothing, and it is the step that catches most of these scams.
Common mistakes to avoid
The most common mistake is scanning to find out whether a code is safe. A scan that opens a page can already expose you to a fake login or a payment trap. Another mistake is trusting a familiar logo, since logos are easy to copy. A third is acting under urgency, which is exactly what the message is designed to create. Slow down, verify through a channel you control, and treat any request for credentials or payment as a reason to stop.
Quick checklist
- Pause before you scan any unexpected code.
- Read the full destination preview, not just the first hop.
- Compare the domain with the official one you already know.
- Check printed codes for sticker edges and mismatched print.
- Never enter passwords, codes, or card details from a surprise scan.
- Verify through a separate, trusted channel before you act.
Related tools and guides
- Run the destination through the [QR batch validator](/qr-batch-validator) before you trust a code you did not expect.
- Inspect the code with the [QR allowlist builder](/qr-allowlist-builder) before you trust a code you did not expect.
- Check the address with the [QR expiry checker](/qr-expiry-checker) before you trust a code you did not expect.
- Practise spotting patterns with the [QR safety checker](/qr-safety-checker) before you trust a code you did not expect.
- Review the chain with the [QR size calculator](/qr-size-calculator) before you trust a code you did not expect.
- Keep a record with the [bulk generator](/bulk-generator) before you trust a code you did not expect.
- Plan protection with the [QR placement guide](/qr-placement-guide) before you trust a code you did not expect.
