QR Code Phishing: How to Spot and Stop "Quishing" at Your Small Business
Short answer: QR code phishing, or "quishing," hides a malicious link inside a QR code so staff scan it with their phone, where email filters and company security tools often can't see it. The fix is a mix of training, a simple rule about scanning codes from email, phishing-resistant sign-in, and alerts on unusual logins.
What is QR code phishing?
Quishing is a phishing attack that uses a QR code instead of a clickable link. The code usually appears in an email or PDF that looks like it came from Microsoft 365, HR, payroll, a shipping company or an e-signature service. The message asks the reader to "scan to review a document," "re-verify your multifactor sign-in" or "view your updated benefits."
When the person scans the code, their phone opens a fake sign-in page. Anything they type, including their password and multifactor code, goes to the attacker.
Why it works so well
Email filters see a picture, not a link. Many filters check links in a message. A QR code is just an image, so the dangerous address can slip through.
It moves the attack to a personal phone. Phones often sit outside the company's security tools, and the small screen makes a fake address hard to spot.
People trust QR codes. Restaurants, parking meters and packages have taught us to scan without thinking.
It can get past basic multifactor sign-in. Fake pages can pass along the code you enter in real time, so the attacker logs in as you. This is the same idea behind device code phishing.
Common quishing lures
"Your Microsoft 365 password expires today. Scan to keep it."
"Multifactor setup required. Scan with your phone."
"You have a secure document waiting. Scan to open."
"Updated payroll or benefits form. Scan to sign."
Fake parking or package notices with a QR code sticker placed over a real one.
Red flags to teach staff
Any email asking you to scan a QR code to sign in to a work account.
Urgency: "today," "final notice," "account will be locked."
A QR code in an attachment from a sender you weren't expecting.
After scanning, a web address that doesn't match the company it claims to be. Read it before typing anything.
A sign-in page that opens from a QR code at all. Real Microsoft 365 prompts don't usually ask you to scan a code from an email.
How to protect your business
Set a simple rule. Staff never scan a QR code from an email or attachment to sign in to anything. If in doubt, go to the site directly or ask IT.
Train with real examples. Include QR code samples in your phishing simulations and awareness training, not just link-based emails. Our post on phishing training for staff covers how to run it.
Move to phishing-resistant sign-in. Passkeys and security keys won't work on a fake page, so a stolen password and code aren't enough. See our guide to phishing-resistant login.
Use Microsoft 365 sign-in policies. Conditional Access can block sign-ins from unmanaged devices or unusual locations, which limits what a stolen login can do.
Watch for account takeover. Alerts on impossible travel, new mailbox forwarding rules and new device sign-ins catch an attacker after a successful scan. Our identity threat detection and response page explains how that works.
Bring phones into the plan. Basic mobile management and a company-approved browser help protect the device that actually scans the code.
Make reporting easy. Give staff one button or one email address to report a suspicious message, and thank them when they use it.
What to do if someone scanned and signed in
Reset the person's password and sign them out of all sessions.
Remove any new multifactor methods or devices the attacker added.
Check for new inbox rules, forwarding and sent messages.
Review recent sign-ins for the account.
Follow your incident response plan, and check whether client or customer data was involved. In Texas, see our post on breach notice deadlines.
Cyber insurers increasingly ask about phishing training and multifactor sign-in, so these steps also help at renewal. See cyber insurance requirements for Texas small businesses.
How 24uNet can help
We help small businesses in Texas and Colorado lock down Microsoft 365 sign-ins, train staff on current phishing tricks, and watch for account takeovers. Start with a network security review or our security baseline.
Frequently asked questions
What is quishing?
Quishing is phishing that uses a QR code instead of a link. Scanning the code opens a fake website that steals sign-in details.
Why don't email filters catch QR code phishing?
A QR code is an image, so filters that scan links in a message may not read the address hidden inside it.
Can multifactor sign-in stop quishing?
Basic multifactor codes can be captured by a fake page. Phishing-resistant options such as passkeys or security keys are much harder to fool.
Is it safe to scan QR codes at all?
Scanning codes in trusted places is usually fine. The risk is codes in unexpected emails or attachments that lead to a sign-in page. Check the web address before entering anything.
What should an employee do after scanning a suspicious code?
Stop, don't enter anything, and report it to IT right away. If they already signed in, IT should reset the password and end all sessions.
Comments