Are QR codes safe? The new wave of “quishing” and how not to get caught

TL;DR. QR-code phishing — nicknamed quishing — jumped roughly 146% in the first quarter of 2026 according to Microsoft, which now sees billions of phishing emails containing QR codes per quarter. Attackers love QR codes because the codes hide the destination URL, sail through email filters as a harmless image, and force the target onto a personal phone where corporate defenses don’t apply. The good news: stopping it does not require new technology — just a couple of simple habits.

Why attackers love QR codes

For decades, the playbook for phishing has been get the target to click a link. Email security gateways, browser warnings, and DNS filters have all gotten pretty good at intercepting that link before it does damage. QR codes route around all of that by design:

• The link is hidden inside an image. A QR code is just a 2-D barcode. To an email filter scanning text, it looks like a picture — not a URL — so the URL is not screened against threat-intelligence feeds.
• The scan happens on a phone. When a user pulls out their personal phone to scan a code, they leave behind every layer of protection their work computer has — corporate DNS filtering, endpoint security, browser isolation, all of it.
• It feels normal in 2026. Restaurants, parking meters, posters, conference badges, package tracking, two-factor setup — QR codes are now part of daily life. People scan them without thinking. KnowBe4 surveys consistently find that around three-quarters of users scan a QR code without checking the URL it produces.

The result: Microsoft’s telemetry shows QR-code phishing surged 146 percent in Q1 2026, and Palo Alto Networks observes more than 11,000 malicious QR-code detections every day. Mimecast saw 716,000 unique malicious QR codes in a single quarter of 2025. This is a fast-growing threat.

Common quishing scams to know about

• Multi-factor authentication setup. An email arrives at a corporate inbox with what looks like a Microsoft, Okta, or Google notification: “You must reconfigure your MFA. Scan the QR code below to enroll.” The QR points to a fake sign-in page that captures the user’s credentials and live MFA token at the same time. This has been the highest-volume quishing attack against businesses for two years running.
• Stickers over real codes. Attackers physically print malicious QR codes on stickers and place them over legitimate codes — on parking meters, restaurant menus, e-bike rentals, gas pumps, public posters. The user pays the “parking ticket” on a fake page, the attacker captures the card.
• Fake delivery notification. A printed notice on your door (or an email) claims you missed a USPS, UPS, or FedEx delivery. Scan to reschedule. The QR points to a fake carrier page that asks for a small “redelivery fee” with your card.
• Fake invoice / vendor email. An accountant gets a PDF invoice that uses a QR code instead of a clickable “Pay Now” button. The QR goes to an attacker’s payment page that looks like a real billing portal.
• Crypto / investment. A QR code on a flyer or social-media post promises an airdrop or token claim. Scanning it leads to a wallet-draining site that asks for a seed phrase.

The simple habits that defeat almost all of it

1. Always preview the URL before tapping. Every modern phone camera, when it scans a QR code, shows the URL before opening it. Pause. Read it. If it does not match the brand, location, or context (a parking meter pointing to a random .shop domain; a restaurant pointing to a Google Doc; a Microsoft “MFA reset” pointing to login.microsoftonline-secure.tld), do not tap.
2. Never enter credentials on a page reached via a QR code. If a QR code takes you to a Microsoft, Apple, Google, or banking sign-in page, stop. Open the app or website yourself, manually. Real sign-in flows are almost never bootstrapped through a printed code.
3. Check physical codes for stickers. Especially on parking meters, gas pumps, and restaurant tables. If you can peel a corner of the code, it is a sticker over the real one. Pay another way.
4. Treat unexpected QR codes in email exactly like unexpected links. If you were not expecting it, do not scan it. Verify on a different channel.
5. Use phishing-resistant authentication. Hardware security keys and platform passkeys (Windows Hello, Touch ID, Face ID) cannot be replayed by quishing kits the way SMS codes and 6-digit one-time codes can. Even if a user falls for a quishing page and types their password, a passkey-protected account stays safe.

For business owners and IT staff

The defenses that matter for an organization, in priority order:

• Phishing-resistant MFA on admin accounts — minimum. If a user falls for a quishing page, a hardware key on the account is what stops the breach.
• Conditional Access policies that block sign-ins from unmanaged or non-compliant devices. When a user’s personal phone scans a malicious QR code and lands on a fake sign-in, Conditional Access can refuse the resulting authentication attempt because it is not coming from a managed device.
• QR-specific phishing awareness training. Generic phishing training does not teach the QR pattern. The training that works is a simulated quishing attack — users get an email with a code, a small percentage scan it without checking, and they get a teaching moment instead of a breach. We can run these for clients on a recurring schedule.
• Print and post the rule. A small reminder near every workstation — “Don’t scan unexpected QR codes. Don’t enter passwords on pages reached by scanning.” — punches above its weight.

QR codes are not going anywhere — they are useful, and the technology is fine. The problem is that they have become an attractive delivery channel because users do not look at the URL. If you make a habit of looking, you eliminate the great majority of the risk.

If you want a quick assessment of how exposed your organization is — or want us to run a quishing simulation against your team to see who needs more training — drop us a line or call 970-282-8838.