QR-Code Phishing: What “Quishing” Is and How to Spot It
QR codes are convenient because they hide a long destination inside a square image. That same convenience creates a security problem: people often scan before they know where the code is taking them.
What “quishing” means
Quishing is phishing delivered through a QR code. The code may open a fake login page, a payment page, a malicious download or a convincing copy of a trusted service. The attack is still phishing; only the delivery method changes.
Why QR codes are attractive to scammers
People have learned to inspect suspicious links in emails, but a QR code hides the link until after scanning. It can also move the victim from a work computer to a personal phone, where different security controls may apply. Google highlighted QR-code phishing as an active scam pattern in its June 2026 fraud advisory. Microsoft Defender's current phishing guidance also identifies QR-code phishing as quishing and notes that QR codes can be embedded in images, PDFs or Word documents, moving the interaction to a mobile device where the destination can be harder to inspect before opening.
Common warning signs
- An unexpected email asks you to scan a QR code to “verify” an account.
- A payment notice creates urgency and tells you not to use the normal app or website.
- A printed QR sticker appears to cover another code underneath.
- The destination domain is slightly misspelled or unrelated to the organization.
- The page asks for a password, one-time code or card details after an unusual QR flow.
A safer way to scan
Before opening the destination, use a camera or scanner that previews the URL. Read the domain carefully. If you already have a QR image or screenshot, the NexusNova QR Code Scanner can decode it locally so you can inspect the result before deciding whether to open anything. If the message claims to be from your bank, email provider or delivery company, opening that company's official app or typing the known website address manually is often safer than trusting the code.
What if the code is on a restaurant menu or poster?
A QR code is not automatically dangerous. Context matters. A menu code at a restaurant, a boarding-pass code or a code you created yourself can be perfectly normal. The useful habit is not “never scan QR codes”; it is “know what should happen before you scan.”
Can a QR image itself infect a phone?
Usually the bigger risk is the destination, not the black-and-white image. Scanning a code typically produces data such as a URL or text. Harm happens when the user follows a malicious link, installs something, grants permissions or submits sensitive information. That distinction helps avoid unnecessary fear while still treating suspicious destinations seriously.
If you already scanned a suspicious QR code
If you only viewed a page and entered nothing, close it and avoid downloading files. If you submitted a password, change it from the legitimate service and review active sessions. If you entered payment information, contact the relevant financial provider promptly. If an app or file was installed, review device security and remove anything untrusted.
Bottom line — QR-Code Phishing
QR codes are useful precisely because they remove friction. Security problems appear when that reduced friction also removes verification. Preview the destination, check the real domain and use official apps or known bookmarks for important account actions.