The Security Gap That Quishing Exploits
Email security gateways (Microsoft Defender for Office 365, Proofpoint, Mimecast) are highly effective at detecting malicious URLs in email bodies. Threat intelligence feeds, URL sandboxing, and real-time scanning catch the vast majority of phishing links.
But these tools typically do not extract and analyse URLs embedded within QR code images. A phishing URL embedded in a QR code image in an email body often passes straight through email security filters undetected.
This is the core technical gap that quishing exploits.
Anatomy of a Quishing Email
A typical quishing email follows this pattern:
1. Impersonated sender: Appears to come from Microsoft, HMRC, PayPal, a bank, or HR/IT department
2. Urgent pretext: "Your account will be suspended," "Action required — verify your details," "Your package is on hold"
3. QR image: Embedded as an image or PDF attachment containing a QR code
4. Instruction: "Scan this code with your phone to complete the verification"
5. Destination: A cloned login page for the impersonated organisation
The victim scans on their personal phone — outside the corporate network, without corporate endpoint protection — and enters their credentials.
Defence Strategies for Organisations
Technical controls:
- Deploy email security tools with QR image decoding capability (Microsoft Defender for Office 365 now includes this; check your vendor's roadmap)
- Block QR codes in PDF attachments from external senders where not expected
- Implement conditional access policies requiring MFA for all logins regardless of how credentials were captured
User awareness training:
- Include quishing scenarios in phishing simulation programmes (KnowBe4, Proofpoint Security Awareness, Mimecast Awareness Training all offer QR phishing simulations)
- Train employees: legitimate internal QR communications are rare; any QR code asking for credentials is a red flag
- Establish a clear reporting mechanism for suspicious QR codes received by email
Process controls:
- Establish a policy: IT and HR will never request credential verification via QR code in email
- Document all legitimate internal QR code use cases — anything outside this set is suspicious
Individual Defence
- Never enter credentials on a page reached via a QR code in an unexpected email
- Verify the destination URL before the page loads (use a QR scanner app that shows the URL preview before opening)
- Report any suspicious QR email to your IT security team and/or Action Fraud
Putting this into practice
Start with the smallest real test you can run. Generate the code, print it at the exact size you plan to use, and scan it with two different phones in the lighting where it will live. Check that the destination page loads quickly on a mobile connection and that the call to action next to the code tells people what they will get. If anything feels slow or unclear, fix it before you print a full batch, because reprints cost more than a short test. Keep a note of the size, material, and placement that worked so the next batch starts from a proven setup.
Common mistakes to avoid
The most common mistakes are easy to avoid once you know them. Long payloads make modules tiny, low contrast makes edges hard to read, and text placed too close to the border eats the quiet zone the scanner needs. Covering a corner finder pattern with a logo or a sticker breaks detection entirely, and a code placed behind glare or on a curved surface fails even when the print is perfect. Review each of these points on a proof copy, and treat any failure as a reason to adjust the design rather than a reason to blame the scanner.
Quick checklist
- Keep the payload as short as practical so modules stay large.
- Keep dark modules on a light background with strong contrast.
- Leave a clear quiet zone on all four sides of the symbol.
- Test the printed code at the real viewing distance and lighting.
- Confirm the destination page loads fast on a phone.
- Recheck the code after any change to the link, design, or placement.
Related tools and guides
- Run unfamiliar destinations through the [QR safety checker](/qr-safety-checker) before you share a code widely.
- Test every code with the [QR scanner](/qr-scanner) on more than one phone before you publish or print it.
- Use the [QR size calculator](/qr-size-calculator) to match the printed size to the expected scan distance before you commit to a print run.
- The [error correction simulator](/error-correction-simulator) shows how damage tolerance changes the density of the symbol at each level.
- Create a fresh code with the [URL QR code generator](/url-qr-code-generator) when the destination is a web page.
- The [blog](/blog) collects more guides on sizing, printing, security, and payments for QR codes.
