QR phishing - sometimes called “quishing” - uses a QR code to lead a person into a deceptive action. The attacker still relies on familiar phishing techniques: impersonation, urgency, lookalike pages, credential theft, malicious downloads, or fraudulent payment. The code hides the destination until it is decoded and can move the interaction from a protected work computer to a personal phone.

Common delivery contexts

A malicious code may arrive in email, a document, postal mail, a parking sign, a package, or a sticker placed over a legitimate code. Context creates borrowed trust. A logo and polished design do not prove who controls the destination.

Avoid publishing operational details that would help an attacker imitate a specific organization’s internal challenge process.

Guidance for users

Preview the destination, compare it with an independently verified domain, and treat unexpected login or payment requests cautiously. Do not use a QR code in an email to authenticate that same email. Navigate through the known application or bookmark instead.

Report suspicious messages and physical labels through the organization’s established channel. Do not forward a live malicious link widely as a warning.

Guidance for publishers

Print the expected domain and specific action beside the code. Use controlled URLs, secure the accounts that manage redirects, inventory public codes, and inspect exposed locations. Establish a rapid way to disable or replace a compromised destination and communicate through independent channels.

Security awareness should explain the decision process rather than teach “QR codes are bad.” Blanket fear can prevent useful accessible applications without addressing lookalike domains or credential pressure.

Original response scenario

Employees receive a printed card saying payroll requires a scan within one hour. The organization’s real payroll process never uses QR cards. A recipient checks the official portal through a bookmark, reports the card, and security preserves one sample for investigation. Communications warn staff without reproducing an active code.

Sources and further reading

Create the code you need

Use HighEndDIY’s private browser tool, then test the result in the setting where people will scan it.

Create a QR Code

Found something that should be corrected? Email help@HighEndDIY.com.