What Is Quishing? QR Code Phishing Explained

Quishing is QR code phishing - a fast-growing scam where criminals hide a malicious link inside a QR code instead of a clickable link in an email. When you scan the code with your phone, you land on a convincing fake page built to steal your passwords, card details, or money. This guide explains what quishing is, how a quishing attack works step by step, the real-world examples making headlines in 2025 and 2026, and a practical checklist you can use to protect yourself.

What Does Quishing Mean?

The word "quishing" is a blend of "QR code" and "phishing." It describes any phishing attack that uses a QR code as the delivery method for a malicious link. Traditional phishing puts a fake link in the body of an email or text and hopes you click it. Quishing swaps that clickable link for a QR code image - in an email, a printed flyer, a letter, a parking meter sticker, or a poster - and hopes you scan it with your phone.

The QR code itself is not malicious and does not contain a virus. It is simply an encoded piece of data, almost always a URL. The danger lives entirely in the destination the code points to. That is why the single most important habit in this whole guide is to look at where a code actually leads before you act on it.

Why Do Attackers Use QR Codes?

Quishing has surged because QR codes solve several problems for attackers at once. Understanding their motivation makes the warning signs easier to recognize.

• They bypass email security filters. Many email security tools scan for malicious links and attachments in text. A QR code is just an image, so a link buried inside it can slip past filters that would have flagged the same URL if it were typed out.
• They move you onto a personal phone. Scanning almost always happens on a mobile device, which is often less protected than a managed work computer and where it is harder to inspect a link or hover to see the real address before you commit.
• They hide the real destination. You cannot read a URL by looking at a QR code. The code visually reveals nothing about where it leads, so a fake domain is completely concealed until you scan.
• They feel routine and trustworthy. People are conditioned to scan QR codes on menus, parking meters, packages, and posters without a second thought, which lowers the natural suspicion that a raw link might trigger.

How a Quishing Attack Works, Step by Step

Most quishing attacks follow the same basic playbook, whether they arrive by email or as a sticker on a parking meter:

1. The lure. The attacker places a QR code somewhere you are likely to trust it - inside an email that looks like it is from your IT department, on a letter that appears to be from a delivery service, or on a sticker slapped over a genuine code in a public place.
2. The hook. A message creates urgency or curiosity: your account will be locked, a package needs redelivery, a toll is unpaid, a document is waiting for your signature. The goal is to get you to scan before you think.
3. The scan. You point your phone camera at the code. It resolves to a URL and offers to open it. This step alone is usually harmless - the risk starts on the next screen.
4. The fake page. You land on a page that closely imitates a real login screen, payment form, or app store listing. It may use a look-alike domain or a shortened link to disguise the real address.
5. The theft. When you enter your username and password, card number, or bank details - or pay a small "fee" - that information goes straight to the attacker. In some variants the page pushes you to install a malicious app instead.

Real Quishing Examples (2025-2026)

Quishing is not theoretical. Here are the forms it has taken most often in recent reports and public warnings. The specifics vary by region, but the pattern is consistent.

Fake stickers on parking meters

One of the most widely reported schemes involves criminals placing counterfeit QR code stickers on public parking meters and pay stations. Drivers scan the sticker expecting to pay for parking and are sent to a look-alike payment page that harvests their card details. Cities in several countries have warned residents to be wary of QR codes stuck onto meters, since many genuine meters do not use QR payment at all.

Fake USPS and package-redelivery messages

A common wave of quishing arrives as texts or letters claiming to be from a postal or courier service. The message says a package could not be delivered and asks you to scan a QR code or tap a link to schedule redelivery or pay a small fee. The page then requests personal and payment information. The U.S. Postal Service and consumer protection agencies have publicly warned about these fake delivery notices.

Toll and traffic-violation text scams

Another prolific variant claims you owe an unpaid road toll or have an outstanding traffic violation, and pressures you to settle it immediately through a QR code or link to avoid penalties. The urgency and the small dollar amount are designed to make paying feel easier than questioning it. The FTC and FBI have flagged unpaid-toll text scams as a large and growing category.

Fake conference and meeting invitations

The FBI has documented quishing campaigns aimed at professionals through fake conference or event invitations. An email invites you to register or view an agenda by scanning a QR code, which leads to a credential-harvesting page mimicking a corporate or event login. Because the code arrives in a business context, it can feel routine.

Swapped QR codes on restaurant tables

With QR menus now normal, attackers have covered legitimate table codes with their own stickers. Diners scan expecting a menu or a way to pay the bill and instead reach a page that asks for card details or a bogus login. This is a classic example of tampering: the physical code was genuine until someone stuck a fake one over it.

Why Quishing Is Surging

Security researchers reported that QR-code phishing rose sharply through 2025, with some measuring roughly a fivefold increase over the prior year. QR codes are now estimated to make up somewhere in the region of 10-12% of phishing payloads, up from a niche technique just a couple of years earlier. Exact figures vary between vendors and methodologies, so treat them as directional rather than precise - but the direction is unmistakably upward.

The trend has been serious enough to prompt public warnings from major authorities. The FBI and its Internet Crime Complaint Center (IC3), the U.S. Postal Service, and the Federal Trade Commission have all issued alerts about malicious QR codes, tampered stickers, and fake delivery, toll, and event messages. When multiple national agencies warn about the same tactic, it is a strong signal that everyday users are being targeted, not just large enterprises.

How to Protect Yourself From Quishing

No single trick makes scanning completely safe, but a short set of habits dramatically reduces your risk and helps you catch the vast majority of quishing attempts before any harm is done.

For a deeper look at the wider threat landscape, see our guides on whether QR codes are safe and the most common QR code scams to watch for. If you run a business and worry about someone hijacking an old code, understanding whether QR codes expire and using permanent QR codes you control closes a gap attackers can otherwise exploit.

What To Do If You Think You Have Been Quished

If you entered information on a page you reached from a suspicious QR code, act quickly to limit the damage:

1. Change your password immediately for any account whose credentials you entered, and turn on two-factor authentication if it is not already active.
2. Contact your bank or card issuer if you entered payment details, so they can watch for or block fraudulent charges and reissue the card if needed.
3. Uninstall anything you were prompted to download from the page, and run a security scan on your device.
4. Report it. Notify your bank, your employer's IT team if it was a work-related lure, and the relevant authority such as the FBI's IC3 or the FTC, which helps them track and warn others.

The Bottom Line

QR codes are a convenient technology, and the vast majority you encounter are perfectly legitimate. Quishing works by exploiting the one weakness built into every QR code: you cannot see where it leads just by looking at it. Build the habit of previewing the destination, staying skeptical of urgency and payment demands, and never entering credentials on a page you reached from a scan. Do that, and you neutralize almost every quishing attempt long before it can cost you anything.

Frequently Asked Questions