What is QR code phishing?

QR code phishing, sometimes called quishing, hides the malicious link in a QR code: in an e-mail attachment, on a printed letter, on a parking meter or on a fake notice in the office. It works for two reasons. Mail filters check links but often cannot read a link inside an image, and people scan the code with their phone, which is usually outside company protection and shows only a short preview of the address. The page that opens typically asks for a Microsoft 365 or other work login, or for card details. Treat a QR code that asks you to sign in like any other link: check the address before entering anything, and if a message urges you to scan a code to keep your account active or to read a document, ask IT first. For companies, phishing-resistant MFA limits the damage when a password is typed into a phone.

← All 29 questions on Phishing and e-mail aftermathAll topics