Quishing Explained

Billboards. Restaurant menus. Payment apps. Product packaging. These are some of the common places where QR codes can be found, inviting users to scan and perform specific actions thereafter.

The same QR codes that made contactless life easier during the pandemic are now being weaponized by cybercriminals through a tactic known as “quishing” or “QR code phishing”.

Tech giant IBM rightfully describes it as “a threat hiding in plain sight”.

Our latest piece explores what “quishing” is, how it works, and ways individuals and organizations can protect themselves from QR-driven attacks.

What Is Quishing?

Quishing is a portmanteau of QR (Quick Response) and phishing. It is a type of cyberattack where cybercriminals use QR codes to trick victims into revealing sensitive information or downloading malware.

This form of cyberattack is an evolution of phishing, because it eliminates the suspicion associated with clicking malicious links.

Attackers disperse these fraudulent QR codes through various means, including email, business cards, and flyers. Because these codes are images, they typically bypass traditional email security filters that check for text-based links, making it more likely that recipients fall victim.

Through QR codes, threat actors simplify the phishing process, exploiting the trust users place in them. Once scanned, they direct users to websites that mimic legitimate web pages to steal credentials or install malware.

Why Quishing Is So Effective

Scanning QR codes has become part of everyday life, from businesses facilitating payments to marketers using them for customer engagement. The convenience and familiarity of this interaction are exactly what cybercriminals exploit for the following reasons:

• Hidden destinations: The URL embedded in a QR code is invisible until scanned, preventing users from verifying it.
• Casual behavior: Scanning happens quickly and instinctively, lowering users’ caution and making them vulnerable to fraudulent sites.
• False trust: Placement on physical items such as flyers or business cards gives QR codes a sense of legitimacy, which cybercriminals exploit.
• Security blind spots: Email filters and text-link scanners rarely detect image-based threats like QR codes.
• Limited awareness: As an emerging attack tactic, quishing is not widely covered in traditional security training. For this reason, many users remain unaware of its risks.

How to Prevent Quishing

With QR code phishing on the rise, both organizations and individuals share responsibility in countering this growing threat. Below are key measures to help prevent or reduce the likelihood of successful quishing attacks.

a. Educate Employees

Organizations must update their security training courses beyond basic password protection and phishing knowledge. The curriculum should incorporate QR-specific examples as a new, modern attack tactic.

Encourage:

• verifying the source before scanning QR codes to ensure it’s sent from a credible source
• using preview apps to inspect the domain associated with unsolicited QR requests
• keeping NFC turned off when not in use (where supported)
• checking for tampering, e.g., suspicious QR labels pasted over another on flyers, posters, or cards.

b. Tighten mobile device security

Since quishing attacks primarily target mobile phones, enhanced protection for mobile devices is necessary. Mobile Device Management (MDM) and Endpoint Detection and Response (EDR) solutions help enforce phishing-resistant MFA, restrict risky app and URL access, and alert security teams when malicious messages are detected.

Company devices should also use modern browsers like Chrome, Edge, or Safari, which display full URLs and security warnings.

c. Establish clear QR code policies

Clear policies and protocols for QR code usage can reduce the number of successful attempts over time. Within organizations, only authorized teams should generate and distribute QR codes, ensuring that all destination URLs are secure.

Additionally, creating a simple reporting channel encourages staff to report any suspicious QR codes or emails. This prevents minor security mishaps from escalating into major breaches.

d. Enhance Email Security

Deploy advanced email gateways that can detect suspicious QR codes and phishing attempts. When a QR code is found in an email, users should be warned to open it in a secure environment.

Advanced email security software like FortiMail can launch sandboxes to safely inspect QR code URLs in secure environments before allowing user access.

The Future of QR Code Security

As QR codes become more relevant to business operations, they’ll be used more often in scams. Yet, banning them outright is not practical. Their simplicity in payments, logistics, and marketing makes them indispensable.

Much like the generative AI boom, organizations must adapt, embracing innovation while maintaining strong cybersecurity standards. The future of QR code security lies in integrating advanced technologies such as AI, blockchain, and dynamic encryption to counter QR-phishing threats.

AI-driven image analysis, URL verification APIs, and blockchain-based authentication are already emerging for this purpose. Moving forward, QR codes may integrate with augmented reality (AR) and the Internet of Things (IoT), combining convenience with intelligent security.

Key Takeaways

While phishing is not new, quishing represents its latest evolution. It targets users directly through their mobile habits to harvest credentials, distribute malware or defraud them.

As cybercriminals continue to create and exploit new entry points, even a single overlooked vulnerability can compromise entire security frameworks or personal assets. To counter this wave of QR-code attacks, we recommend:

• reinforcing mobile devices with advanced security tools,
• previewing URLs before opening,
• scanning only codes from trusted sources,
• using scanners that display the destination URL, and
• avoiding entering credentials after scanning.

Together, these measures help protect both individuals and organizations against quishing attempts.