QR codes went from a niche technology to something people scan without thinking twice. Restaurant menus, parking payment machines, contactless payments at events, delivery confirmations — the habit of pointing your phone at a square and following where it leads has been normalised quickly. Attackers have noticed.

Quishing — QR code phishing — is the use of malicious QR codes to redirect victims to credential harvesting pages, malware downloads, or fraudulent payment portals. It’s not a new concept, but it’s grown significantly as an attack vector since 2024. The NCSC flagged quishing specifically in its 2025 threat report as an area of increasing concern for UK organisations of all sizes.

The reason it works particularly well is the same reason any technology-exploiting attack works: it hides in a trusted behaviour. If you’ve been confidently scanning QR codes for two years to pay for parking or access a menu, the scepticism you’d apply to an unexpected email link doesn’t automatically transfer to QR codes.

How Quishing Attacks Work

The mechanics vary by scenario, but the core technique is consistent: embed a URL in a QR code rather than displaying it as readable text. Email security gateways and spam filters that scan for malicious URLs in email text typically don’t scan the content of embedded images. A QR code is just an image file — the malicious URL is invisible to most automated scanning tools.

Email quishing

The most common delivery mechanism for business targets is email. The attacker sends what appears to be a legitimate communication — an invoice, a document signature request, a parcel delivery notification, a supplier portal access prompt — with a QR code image replacing the usual clickable link.

The email says something like: “Please scan the QR code to verify your delivery address” or “Scan to approve this invoice in our secure portal.” The recipient scans it on their phone, lands on a convincing replica of Microsoft 365, their bank login, or a supplier portal, and enters their credentials.

The phone is an important element here. Security awareness trained around laptop browsing doesn’t transfer automatically to phone usage. Mobile browsers show truncated URLs. Mobile screens make visual inspection harder. And the phone is outside the corporate security perimeter — it’s not subject to your organisation’s endpoint security software or content filtering.

Physical quishing

QR codes on physical materials are another vector. Reported UK incidents include:

Parking payment machines: Fraudulent QR code stickers placed over legitimate council parking payment QR codes, redirecting to fake payment pages that collect card details. This has been documented at sites across the UK including London and Manchester.

Restaurant and café Wi-Fi: Fake “free Wi-Fi access” QR codes placed on tables in public venues, directing victims to Wi-Fi registration pages that harvest personal details or email credentials.

Package delivery cards: Fake delivery missed-parcel cards left at premises with QR codes that direct to credential harvesting pages mimicking DPD, Royal Mail, or DHL customer portals.

Printed supplier materials: QR codes on physical order confirmations, service brochures, or product materials that have been compromised before or after printing.

Invoice fraud variant

A specific concern for UK small businesses is the invoice quishing variant. A fraudulent invoice arrives from what appears to be a regular supplier — possibly using a spoofed or look-alike domain — with a QR code to “verify bank details” or “approve payment through our secure portal.”

The victim scans the code, lands on a convincing portal page, and provides login credentials or payment information. This often combines quishing with mandate fraud (the impersonation of suppliers to change bank payment details).

Why Standard Email Security Often Misses It

Most email security gateways and Microsoft 365 / Google Workspace anti-phishing controls work by:

  • Scanning embedded URLs in email text
  • Checking sender domain reputation
  • Analysing email header metadata
  • Filtering known malicious domains

QR codes embedded in email images bypass the first control entirely. The image is processed as an attachment, not scanned for URL content. The malicious URL is encoded in the QR image — invisible to text scanning — and only decoded when the recipient’s phone camera processes it.

Some enterprise-grade email security products (including Proofpoint, Mimecast, and certain Microsoft Defender for Office 365 add-ons) now include QR code URL extraction as a specific scanning capability, using image recognition to decode QR codes before delivery. These are more common in large enterprise than in small business email configurations.

What this means practically: if your email security consists of Microsoft 365 standard protection or Google Workspace’s built-in filtering, you are likely not scanning QR codes in incoming emails for malicious URLs.

Recognising Quishing Attempts

Training staff to recognise quishing is the most effective control, because technical controls are still catching up. Key indicators:

QR code in an unexpected context: Legitimate business emails from established suppliers or services you recognise typically don’t suddenly switch to QR codes for link delivery. A QR code in an email from a supplier you’ve dealt with for years, appearing for the first time, is a warning sign.

QR code replacing a clickable link: If an email that would normally have a “click here to view your invoice” link instead has a QR code for the same action, ask why. There’s rarely a legitimate reason for this substitution in a supplier email.

Urgency plus QR code: The combination of urgency language (“your payment is overdue,” “this is a final notice,” “your account will be suspended”) with a QR code for action is a strong indicator of attempted fraud.

Physical QR code that looks added, not printed: On parking machines or signage, look for QR codes that appear to be stickers applied on top of the original surface rather than printed as part of the original material. Sticker placement, slight misalignment, or peeling edges are physical signs.

URL preview before scanning: When you point your phone camera at a QR code, most modern camera apps show a URL preview before opening the link. Read it. If the URL domain doesn’t match what you’d expect — for a Microsoft 365 portal it should be microsoft.com or login.microsoftonline.com, not something like “ms-auth-portal.net” — don’t proceed.

Controls for Small Businesses

Train staff specifically on QR codes: General phishing awareness training often doesn’t cover QR codes. Add a specific module on quishing to your next training session. The key message: apply the same scepticism to QR codes as to unexpected email links, because they are unexpected email links in disguise.

“Verify by other means” for financial actions: Any QR code associated with a payment request, bank detail change, or supplier portal access should trigger a verification call to a known number. Do not use the contact details in the email — look up the supplier’s number independently.

Check URL preview before tapping: Make it standard practice to read the URL preview when scanning any QR code, particularly in emails or on unfamiliar physical materials. This is a habit change rather than a technology control.

Enable Microsoft Defender’s QR scanning if available: If you’re on a Microsoft 365 Business Premium or higher licence, check whether Advanced Phishing protection with QR code scanning is enabled in your Defender for Office 365 configuration. This is one of the few technical controls currently effective against email quishing.

Examine physical QR codes before scanning: Particularly on parking meters, payment machines, and public signage, look for sticker placement. When in doubt, use the machine’s card payment option rather than the QR code.

Report suspicious QR codes: The NCSC’s Suspicious Email Reporting Service (SERS) accepts reports of phishing emails including those containing malicious QR codes. Reporting helps the NCSC track trends and take down fraudulent sites faster. Forward suspicious emails to report@phishing.gov.uk.

If You’ve Already Scanned a Suspicious QR Code

If someone in your business has scanned a QR code that led to a suspicious or unexpected page:

  1. Don’t enter any credentials or payment details if you haven’t already. If you have, proceed to step 2 immediately.

  2. Change affected passwords immediately — particularly for the account the page was impersonating. If it was a Microsoft 365 login page, change your Microsoft 365 password from a separate, known-good device.

  3. Check for account compromise: Review login activity in your Microsoft 365 or Google Workspace admin console for unexpected sessions or forwarding rules that might have been set up if credentials were captured.

  4. Enable MFA immediately if it isn’t already on. Captured credentials with MFA active reduce the attacker’s ability to use them.

  5. Report to Action Fraud: If financial loss has occurred or you believe credentials have been compromised and used, report to Action Fraud (actionfraud.police.uk or 0300 123 2040).

  6. Notify your bank immediately if payment card details were entered on any page reached via QR code.

Quishing’s effectiveness depends on the gap between how carefully people evaluate email links versus how casually they treat QR code scans. Closing that gap through awareness is the most accessible control available to small businesses today.