Cybersecurity glossary
What is Quishing?
Learn what quishing is, why QR codes bypass email link inspection and user URL checks, how attackers use posters and invoices, and how to scan more safely.
Definition
Quishing is phishing that uses a QR code as the delivery mechanism so the victim’s camera—not a visible hyperlink—opens the malicious site, often bypassing email link rewriting, desktop hover checks, and hurried visual inspection.
Why a square of pixels skips years of email defense
Security teams spent a decade teaching people to inspect links. Quishing asks them to point a camera at a picture instead. The URL is not in the HTML href that secure email gateways rewrite. It is in a bitmap. Filters that detonate hyperlinks may leave the image untouched. Users who would hesitate at rnicrosoft.com never see that string until their phone is already loading it.
QR codes also feel operational rather than promotional. People scan them to pay for parking, join Wi-Fi, open a menu, check in to a conference, or view an invoice PDF. That ritual is the social-engineering payload. The attacker does not need a clever subject line if the physical or document context already says “scan here to continue.”
Mobile browsers then finish the job: truncated address bars, installed-app prompts, and cramped certificate UI.
How quishing campaigns are delivered
Encode a hostile destination
Generate a QR code for a lookalike login, payment page, malware drop, or AitM proxy.
Place the code where scanning is normal
Embed it in an invoice PDF, a ‘MFA setup’ poster, a parking sign overlay, or a conference badge email.
Skip the visible hyperlink
Email and print flows that security tools inspect for URLs may only see an image or a piece of paper.
Force a phone context
The victim leaves the desktop mail client and lands in a mobile browser with less URL visibility.
Harvest on a small screen
Collect credentials, cards, or session cookies, often with a page that mimics a brand the user just scanned ‘officially.’
Rotate the encoded host
Reprint or regenerate codes quickly when a domain is burned, including on physical stickers overnight.
Two environments, one technique
In the inbox
A PDF or HTML email says the invoice, parking pass, or MFA enrollment can only be opened by scanning. Link rewriting never sees the host.
On the street
A sticker covers the real restaurant, meter, or poster code. Surrounding branding stays legitimate; the destination is swapped.
In the workplace
Flyers for ‘new VPN,’ ‘guest Wi-Fi,’ or ‘benefits portal’ appear on fridges and badge printers where staff are used to scanning.
In customer journeys
Fake utilities and delivery brands mail or tape codes that collect payment methods for a ‘missed’ service.
Quishing versus other mobile lures
| Lure | How the URL is hidden | Typical tell |
|---|---|---|
| Quishing | Encoded in an image or sticker | Unexpected need to scan instead of using the usual app |
| Smishing | Truncated in an SMS preview | Unsolicited text with a short link |
| Email phishing | Display text differs from href | Mismatch on hover or rewritten URL |
| Evil twin portal | Captive portal replaces the next page | Login required to use venue Wi-Fi |
Scanning without inheriting the destination blindly
- Use a camera or scanner that previews the full decoded host before opening a browser, and abort on lookalikes or newly registered domains.
- Do not scan QR codes in unexpected email, Slack, or PDF invoices when the vendor already has an authenticated portal.
- On physical codes, check for stickers, extra plastic, or a code that sits off-center on official signage.
- Prefer official apps with deep links over camera-to-browser flows for payments, parking, and workplace login.
- Configure secure email gateways to decode and detonate QR images, not only HTML hyperlinks.
- Ban unsolicited QR-based MFA enrollment; onboard authenticators through an already-signed-in session.
- If a scan leads to a login, treat it like any other phish: never reuse the password flow you did not initiate in the official app.
- Inspect conference and office posters the same way you inspect USB drops—unauthorized codes are unauthorized infrastructure.
Email security has a camera-shaped hole
If your phishing simulations, URL rewriting, and user training all assume a clickable https:// string, you are grading the wrong exam. Add QR payloads to awareness, to gateway inspection, and to incident playbooks. A reported “weird square on the invoice” should be handled with the same urgency as a reported link.
The practical takeaway
Quishing is phishing that waits to reveal the URL until after the victim has committed a scan. It evades hover checks, many mail filters, and the habit of reading desktop links.
Decode first, navigate second. If the host is not the brand you thought you were scanning, close the tab and use a channel you already trust. For defenders, inspect images as destinations—because attackers already do.
Related security terms
Phishing
Quishing is phishing with the destination encoded in a scannable image instead of a visible URL.
Smishing
Both target mobile habits; smishing uses a texted link, quishing uses a code the camera must decode.
Typosquatting
Decoded QR destinations often land on lookalike domains that are hard to read on a phone after the scan.
Homograph Attack
Confusable characters in the decoded host add another layer once the user is already in a mobile browser.
Social Engineering
Posters, parking signs, and ‘scan to view the invoice’ rituals make scanning feel like a normal errand.
Frequently asked questions
What is quishing in simple terms?
Quishing is a phishing attack hidden in a QR code. You scan what looks like a menu, parking sign, or invoice code and your phone opens a fake site instead of the real one.
Why do attackers prefer QR codes over links?
Many email gateways rewrite or sandbox HTTP links but treat images as attachments. Users also cannot hover a QR code. The destination appears only after the camera app has already navigated.
Is every QR code in an email dangerous?
No, but unexpected codes that skip your usual portal are a warning. Open the vendor’s known website or app and retrieve the document there instead of scanning mail images.
How do physical quishing scams work?
Attackers stick a new code over a legitimate restaurant, meter, or conference poster. The branding around the sticker stays real; only the destination changes.
Can I see the URL before opening it?
Some camera apps preview the decoded URL. Read the full host, not the path. If the app jumps straight into a browser, treat unexpected codes as untrusted.
Does HTTPS mean the QR code is safe?
No. Attackers put valid certificates on domains they own. A padlock after a scan only proves encryption to that host.
How should companies handle QR codes in customer mail?
Prefer deep links in official apps, signed portals, or already-rewritten text URLs. If you must use QR codes, keep them inside authenticated sessions and educate users that you will not email surprise codes for login or payment.
References
Explore authoritative guidance and frameworks related to quishing.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.