What Is QR Code Phishing (Quishing)?
QR code phishing — known as "quishing" — is a cyberattack where a malicious QR code redirects the scanner to a fake website designed to steal login credentials, payment information, or personal data. The QR replaces the traditional email link in a phishing attack because:
- Email security filters scan URLs in email bodies but may not decode QR images
- Users are conditioned to trust QR codes as benign
- Smartphone users scanning QR codes are often away from corporate security tools
How Quishing Attacks Work
Method 1 — Sticker replacement:
A malicious QR sticker is placed over a legitimate QR code (on a parking meter payment terminal, a restaurant table card, or a public health poster). The user scans what appears to be the genuine code.
Method 2 — Email attachment:
A phishing email includes a QR image with the message "Scan to verify your account" or "Scan to complete your delivery." The QR leads to a fake login page.
Method 3 — Physical mail:
Fake invoices, bank letters, or HMRC correspondence with a QR linking to a phishing page. Physical mail is trusted by many consumers more than email.
Method 4 — Social engineering:
A fake "free WiFi" QR at a café or airport leads to a page requesting personal details before "granting" access.
Red Flags When Scanning QR Codes
Before scanning:
- QR sticker appears applied over a printed element (raised edges, misalignment)
- QR in an unexpected location (on a cash machine, on a car windscreen)
- QR in an unsolicited email or physical letter asking for immediate action
After scanning (before entering any information):
- The URL in the browser preview does not match the expected organisation
- The URL uses a non-official domain (.xyz, .info, random characters)
- The page asks for login credentials immediately without explaining why
- The padlock (HTTPS) is absent or shows a certificate warning
- The page is poorly formatted or has spelling errors
Safe Scanning Habits
1.
Preview the URL before opening. Most modern smartphone cameras show the destination URL when a QR is detected — read it before tapping "Open."
2.
Verify before entering credentials. If a scanned QR asks for a password, close the page and navigate to the organisation's site directly via your browser.
3.
Be sceptical of physical QR stickers. In environments where fraud is a known risk (parking meters, restaurant tables in tourist areas), check for overlay stickers.
4.
Report suspicious QR codes. In the UK, report to Action Fraud (0300 123 2040) or via actionfraud.police.uk.
Putting this into practice
Start with the smallest real test you can run. Generate the code, print it at the exact size you plan to use, and scan it with two different phones in the lighting where it will live. Check that the destination page loads quickly on a mobile connection and that the call to action next to the code tells people what they will get. If anything feels slow or unclear, fix it before you print a full batch, because reprints cost more than a short test. Keep a note of the size, material, and placement that worked so the next batch starts from a proven setup.
Common mistakes to avoid
The most common mistakes are easy to avoid once you know them. Long payloads make modules tiny, low contrast makes edges hard to read, and text placed too close to the border eats the quiet zone the scanner needs. Covering a corner finder pattern with a logo or a sticker breaks detection entirely, and a code placed behind glare or on a curved surface fails even when the print is perfect. Review each of these points on a proof copy, and treat any failure as a reason to adjust the design rather than a reason to blame the scanner.
Quick checklist
- Keep the payload as short as practical so modules stay large.
- Keep dark modules on a light background with strong contrast.
- Leave a clear quiet zone on all four sides of the symbol.
- Test the printed code at the real viewing distance and lighting.
- Confirm the destination page loads fast on a phone.
- Recheck the code after any change to the link, design, or placement.
Related tools and guides
- Run unfamiliar destinations through the [QR safety checker](/qr-safety-checker) before you share a code widely.
- Test every code with the [QR scanner](/qr-scanner) on more than one phone before you publish or print it.
- Use the [QR size calculator](/qr-size-calculator) to match the printed size to the expected scan distance before you commit to a print run.
- The [error correction simulator](/error-correction-simulator) shows how damage tolerance changes the density of the symbol at each level.
- Create a fresh code with the [URL QR code generator](/url-qr-code-generator) when the destination is a web page.
- The [blog](/blog) collects more guides on sizing, printing, security, and payments for QR codes.
