QR codes are everywhere — restaurant menus, parking meters, corporate emails. You scan one and a webpage opens. But unlike a regular link, you can't hover over a QR code to preview the URL. Attackers know this. That's why QR code phishing bypasses email filters, evades URL previews, and catches people off guard in ways traditional phishing can't.
QR code phishing attacks increased 587% in 2023 compared to the prior year, according to security researchers. Quishing now accounts for a growing share of all phishing campaigns — and most email security gateways still can't scan the URLs embedded inside QR code images.
The attack is simple but effective. An attacker encodes a malicious URL into a QR code and places it somewhere a victim will scan it — an email, a flyer, a sticker on a parking meter. Because the URL is hidden inside the image, neither the victim nor their email filter can see where it leads until it's too late.
The attacker generates a QR code that encodes a phishing URL — often behind a URL shortener or redirect chain to further obscure the final destination. The QR code is embedded in an email, printed on a sticker, or placed on a poster.
The victim scans the QR code with their phone camera. The phone shows a URL preview, but most people tap "Open" without reading it — especially when the context feels trustworthy (a work email, a parking meter, a restaurant table). The link opens in the phone's mobile browser.
The URL loads a convincing phishing page — a fake Microsoft 365 login, a bank verification form, or a payment portal. On mobile, the smaller screen makes it even harder to notice a suspicious domain in the address bar.
The victim enters their username, password, or payment details. The data goes straight to the attacker's server. Advanced kits also capture MFA codes in real time, completing the account takeover within seconds.
Quishing works because it hits several blind spots at once — both technical and human:
Attackers place sticker QR codes over legitimate ones on parking meters in major cities. Drivers scan to pay for parking and land on a fake payment page that collects their credit card details. The real parking meter still shows "unpaid," so the victim also gets a ticket. This attack has been documented in Austin, Houston, San Antonio, and multiple European cities.
An email impersonating the company's IT department tells employees to scan a QR code to "enroll in our new multi-factor authentication system." The QR code leads to a fake Microsoft 365 login page. Because the email references a real security policy and the QR code feels like a legitimate IT onboarding step, employees comply without question. The attacker harvests hundreds of corporate credentials in a single campaign.
A restaurant uses QR codes on tables for digital menus — standard post-pandemic practice. An attacker visits the restaurant and replaces the table QR stickers with ones pointing to a phishing site that mimics a Wi-Fi login portal. Diners "connect to the restaurant WiFi" by entering their email and creating a password — a password they likely reuse elsewhere. The attacker now has a working email-password pair for credential stuffing.
PhishClean can't scan QR codes — no browser extension can. But that's not where the damage happens. The damage happens when you land on the phishing page and enter your credentials. That's exactly where PhishClean operates.
When you scan a QR code and the phishing page loads, PhishClean checks the page the same way it checks every other page:
ms365-verify.com. PhishClean flags the discrepancy.PhishClean doesn't care how you got to the page — link, QR code, redirect chain. It just checks what the page is doing and warns you if something's wrong. No data leaves your browser.
The broader category — how phishing works across email, SMS, and now QR codes.
What happens after credentials are stolen — how attackers take over active sessions.
Already scanned a suspicious QR code? Step-by-step damage control guide.
Quick checks to verify a website before entering any personal information.
Quishing pages may also strip HTTPS — learn how downgrade attacks work.
What is quishing?
Quishing is a form of phishing that uses QR codes instead of clickable links to direct victims to malicious websites. The term combines "QR" and "phishing." Because QR codes hide the destination URL, victims can't preview where they're going before scanning — making it easier for attackers to bypass both email security filters and human judgment.
Can my phone get hacked just by scanning a QR code?
Scanning a QR code alone doesn't hack your phone — it simply opens a URL in your browser. The danger comes from what happens next: if the URL leads to a phishing page and you enter your credentials, or if it triggers a malicious download. Always preview the URL your phone's camera shows before tapping to open it.
How does PhishClean protect against QR code phishing?
PhishClean works at the browser level, analyzing every page you land on — regardless of how you got there. After you scan a QR code and open the link, PhishClean checks the page for phishing signals like domain mismatches, suspicious form actions, hidden iframes, and credential harvesting patterns. It catches the phishing page even though it can't intercept the QR code itself.
QR codes hide the URL, but they can't hide what the landing page does. PhishClean catches phishing at the page level — no matter how you got there.
Install PhishClean