What Is Quishing: QR Code Scams That Can Harm Your Business

Quishing is a phishing attack that encodes a malicious URL inside a QR code, redirecting victims to credential-harvesting pages while bypassing every email security filter your organization has deployed.

Your gateway never sees it coming. To every scanner in your stack, a QR code is just an image.

Most enterprise email security platforms cannot extract or inspect URLs embedded in QR codes, which means the controls your organization paid to build have a blind spot attackers are actively exploiting. QR-based phishing attempts rose 587% between in 2023, and finance teams, executives, and HR personnel sit squarely in the crosshairs.

The attack is fast. From scan to credential submission, a compromise can close in under two minutes, entirely on a mobile device your endpoint tools never touch.

This article breaks down exactly how quishing works, which employees and entry points carry the highest risk, why the threat outpaces standard phishing, and what your security team should do this week to close the gap before an attacker finds it first.

What Is Quishing and Why It Targets Businesses

Quishing is a phishing attack that encodes a malicious URL inside a QR code, redirecting victims to credential-harvesting pages, fake login portals, or malware downloads. The name combines “QR” and “phishing,” but the mechanics create a fundamentally different threat profile. Standard phishing links must survive reputation filters, link scanners, and sandboxing. A QR code skips all of it because it arrives as an image, and images don’t trigger URL inspection engines.

The business context accelerates the risk. Employees scan QR codes without hesitation because the format appears constantly in legitimate work settings: conference room Wi-Fi cards, vendor invoices, onboarding documents, and event materials. That ambient trust is the vulnerability attackers actually exploit, not a technical gap but a behavioral one. The scan happens on a personal or corporate phone, outside the corporate network, where endpoint detection and DNS filtering have no visibility whatsoever.

Why QR Codes Evade Standard Email Security

Most email security gateways treat embedded images as inert content. To the scanner, a QR code is indistinguishable from a company logo or a decorative graphic. The malicious URL lives inside the pixel pattern, invisible until a smartphone camera reads it. By the time an employee scans the code, the attack has already moved past every automated control the organization paid to deploy. That gap between image processing and URL inspection is where quishing campaigns operate with near-zero detection risk.

How a Quishing Attack Actually Works

A quishing attack moves a malicious URL out of the text layer where security tools look and into a pixel pattern no scanner reads without a camera. The attacker embeds the URL inside a QR code, then delivers that code by email, printed invoice, or a sticker placed over a legitimate sign. When an employee scans it, their phone resolves the URL directly, bypassing every corporate gateway that sits between an inbox and the internet. The redirect lands them on a credential-harvesting page built to mirror Microsoft 365, DocuSign, or a payroll portal with near-perfect visual accuracy.

The attack chain is short. From scan to credential submission, the entire compromise can close in under 90 seconds, and because the transaction happens on a mobile device, endpoint detection on corporate laptops never registers the traffic.

The Role of Redirects and URL Shorteners

Attackers rarely point the QR code straight at the malicious domain. Layering a legitimate redirect service, such as a bit.ly link or a Google AMP page, between the code and the payload adds credibility and breaks forensic tracing. Security teams investigating the incident often recover only the redirect URL, not the actual destination where credentials were harvested, which delays containment and makes attribution harder.

Which Employees and Entry Points Attackers Prioritize

Quishing campaigns are not random. Attackers target executives, finance teams, and HR personnel because those roles control wire transfers, payroll platforms, and sensitive personnel records. Vendor communications are a particularly high-risk delivery channel because employees are conditioned to expect QR codes on shipping notices, invoices, and supplier onboarding forms. A finance employee scanning what looks like a routine vendor invoice QR code is one of the highest-probability compromise scenarios in enterprise security today.

Physical entry points compound the problem in ways email filters cannot address. QR codes planted in office lobbies, affixed to shared printer stations, or placed inside conference room displays target anyone in proximity, regardless of role or seniority. Attackers use sticker overlays on existing legitimate signage, making the substitution nearly invisible to casual inspection.

Why Executive Targets Face Elevated Risk

Executives routinely scan QR codes from event badges, travel itineraries, and briefing materials, contexts where suspicion is low and speed is the norm. Their devices frequently store MFA authenticator apps, corporate SSO credentials, and direct email access. A single compromised executive device can open lateral access across the organization within hours, making the executive attack surface disproportionately valuable relative to the effort required to exploit it. See more about Digital Executive Protection vs. Traditional Physical Security for additional context.

Does Quishing Threaten Businesses More Than Standard Phishing?

Quishing is more operationally dangerous than standard phishing because it bypasses the controls organizations have already built. Standard phishing must defeat link scanners, sandboxes, and URL reputation filters before reaching an inbox. Quishing skips that entire gauntlet by encoding the malicious URL inside a camera-readable image.

The real threat multiplier is the device gap. When an employee scans a QR code on a personal phone, that traffic never touches the corporate network, the endpoint detection tool on their laptop, or the DNS filtering layer that blocks known malicious domains. The attack resolves entirely outside your security perimeter. Hybrid work makes this worse, not better. Employees scanning codes at home, on hotel Wi-Fi, or at conferences operate with zero corporate controls between them and the payload.

Measuring the Gap in Current Security Controls

Most organizations discover they cannot answer three basic questions: how many employees scan work-related QR codes on personal devices, whether their mobile device management policy addresses off-network scanning, and whether their email security vendor extracts and inspects URLs embedded in QR images.

An organization that cannot answer all three has an unaudited attack surface, not just a training gap. Closing that gap starts with asking vendors a single direct question: does your platform treat QR code images the same way it treats hyperlinks? Learn about implementing digital executive protection to enhance your security posture.

Recognizing a Quishing Attempt Before the Scan

Employees who know what to look for stop quishing attacks before they start. The strongest defense activates before the scan happens, not after. QR codes that arrive unexpectedly in email, particularly those that create urgency around password resets, payroll updates, or account verifications, warrant immediate suspicion. Legitimate vendors almost never require a QR code scan to access sensitive account functions, so that combination of delivery method and urgency is a reliable warning sign.

Physical placement matters just as much as digital delivery. Attackers print QR code stickers and layer them directly over legitimate codes on office signage, conference room displays, and shared equipment. A slight misalignment, bubbling edges, or a sticker surface where a flat print is expected signals tampering that is worth reporting before anyone scans.

Behavioral Cues That Signal a Malicious Code

The URL that appears briefly in a mobile browser after scanning is the most overlooked verification point in any organization’s quishing defense. That preview window shows the actual destination before any redirect fires. Employees should treat any mismatch between the expected sender’s domain and that preview URL as a hard stop.

Training staff to read that URL, not just tap past it, closes the single widest gap in current quishing defenses without requiring any new technology. For further insights, explore The Psychology of Social Engineering.

What Businesses Should Do Right Now

Three actions belong on the security team’s desk this week: configure email security tools to extract and inspect URLs embedded in QR code images, establish a clear policy requiring employees to verify QR code destinations before submitting any credentials, and add quishing scenarios to regular phishing simulation programs.

Most enterprise simulation platforms still default to text-link attacks, which leaves employees completely unprepared for image-based delivery. Physical security belongs in this conversation, too. Security leaders should coordinate with facilities teams to establish reporting protocols for suspicious QR codes found on office signage, printers, and conference room equipment.

Evaluating Vendor Readiness on QR Threat Detection

When reviewing email security vendors, ask two direct questions: does the platform extract URLs from QR code images in both scanned attachments and inline images, and does that extracted URL pass through the same reputation and sandbox analysis applied to standard hyperlinks?

Vendors who cannot confirm both capabilities leave a measurable, exploitable gap. Asking those questions before renewal costs nothing. Discovering the gap after a credential compromise costs considerably more. For a comprehensive approach, see How Digital Executive Protection Stops Attacks on Leaders.

Conclusion

Ask your email security vendor today whether QR code images receive the same URL inspection as hyperlinks. That single question separates vendors with real quishing coverage from those with a documented blind spot.

If the answer isn’t an immediate yes, your team is scanning blind.

The next step is to pull one quishing scenario into your next phishing simulation before the quarter closes.

Invest in digital executive protection and start protecting your business from quishing and other social engineering attacks.