QR code phishing, or quishing, hides a phishing link inside a QR code. The email asks you to scan it, often to secure your account or sign a document. The code opens a fake sign-in page on your phone. The safest rule is short: never scan a code in an email to sign in or to pay.
What is quishing?
A QR code is a link printed as a picture. Quishing uses that picture in place of a link you could read. The rest is ordinary phishing: a reason to act, a deadline, and a page that asks for your password or your card. The NCSC judges the codes on pub and restaurant tables probably safe. The risk is a code that arrives in an email and asks you to sign in.
Why attackers put QR codes in emails
The UK's National Cyber Security Centre gives three reasons. People have learned to distrust links. Some email filters do not scan images. And the phone that scans the code usually lacks the protections of a work computer.
The FBI describes the same move from the attacker's side. In a January 2026 alert on the North Korean group Kimsuky, it said QR codes force victims to pivot from their corporate computer to a mobile device. That step bypasses the email security that inspects, rewrites or tests links. The rest of the attack happens on a phone outside the company's monitoring.
Real QR code phishing campaigns
- A US energy company, 2023. Cofense documented more than 1,000 emails posing as Microsoft security notices, with the QR code in an image or a PDF. About 29% went to one large US energy company. The codes led through Bing redirects to fake Microsoft 365 sign-in pages.
- Think tanks, universities and government bodies, 2025. The FBI's alert describes Kimsuky emails with QR codes that led to mobile sign-in pages impersonating Microsoft 365, Okta or VPN portals, and in one case Google. The attackers stole session tokens, which let them get past multi-factor authentication, then sent more phishing from the victims' mailboxes.
How to spot a QR code phishing email
The FTC's advice is not to scan a QR code in an email you did not expect, especially one that urges you to act now. The NCSC says to be wary of scanning QR codes in emails at all. Watch for these:
- A security notice, a password expiry or a document to sign, with a code where a link would usually be.
- A deadline: the account will be locked, the document will expire.
- A sender that is not the service it names. The seven checks for Gmail and Outlook show how to read the real address.
A genuine account alert never needs a QR code, because you can go to the service directly.
If you decide to scan a code
- Use the phone's own camera, not a third-party scanner app. The FBI and the NCSC both advise it.
- Check the address before you sign in. The FBI says to confirm that the page is the site you intended and to look for typos or swapped letters in the address.
- Do not enter a password or card details on a page that a code in an email opened. Type the service's address yourself instead.
- Do not install an app from a QR code, the FBI says.
- Verify payment requests by phone. If an email says you can only pay by scanning a code, the FBI advises calling the company on a number you know.
If you already scanned it and signed in
Treat the password as known. Change it from a device you trust, sign out of every session and check your mail for new forwarding rules. On a work account, tell IT at once. The steps are in what to do if you clicked on a phishing link. The FBI's mitigation list also recommends phishing-resistant multi-factor authentication, such as passkeys or hardware keys, which a fake page cannot replay.
What Antilure draws for a QR code lure
On a message that pushes you to act with a deadline or asks for your sign-in details, Antilure draws a banner inside the email in Gmail or Outlook, marks the phrases that create the pressure, and explains the sender, on your own computer. Download Antilure.
Sources
- North Korean Kimsuky Actors Leverage Malicious QR Codes in Spearphishing Campaigns Targeting U.S. Entities, FBI FLASH AC-000001-MW, 8 January 2026.
- Cybercriminals Tampering with QR Codes to Steal Victim Funds, FBI Internet Crime Complaint Center, 18 January 2022.
- Scammers hide harmful links in QR codes to steal your information, Alvaro Puig, US Federal Trade Commission, 6 December 2023.
- QR Codes: what's the real risk?, Dave Chismon, National Cyber Security Centre, 8 February 2024.
- How to spot a scam email, text message or call, National Cyber Security Centre, reviewed 5 September 2022.
- Major Energy Company Targeted in Large QR Code Phishing Campaign, Nathaniel Raymond, Cofense, 16 August 2023.