# What is QR code phishing?

QR code phishing, sometimes called quishing, hides the malicious link in a QR code: in an e-mail attachment, on a printed letter, on a parking meter or on a fake notice in the office. It works for two reasons. Mail filters check links but often cannot read a link inside an image, and people scan the code with their phone, which is usually outside company protection and shows only a short preview of the address. The page that opens typically asks for a Microsoft 365 or other work login, or for card details. Treat a QR code that asks you to sign in like any other link: check the address before entering anything, and if a message urges you to scan a code to keep your account active or to read a document, ask IT first. For companies, phishing-resistant MFA limits the damage when a password is typed into a phone.

FAQ: [Phishing and e-mail aftermath](https://netsenx.com/en/faq/phishing) · https://netsenx.com/en/faq/what-is-qr-code-phishing

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/what-is-ndr

## Related questions

- [What is business e-mail compromise (BEC)?](https://netsenx.com/en/faq/what-is-business-email-compromise)
- [Can network monitoring stop CEO fraud?](https://netsenx.com/en/faq/can-network-monitoring-stop-ceo-fraud)
- [Can a phishing e-mail come from a colleague's real account?](https://netsenx.com/en/faq/can-phishing-come-from-a-colleagues-real-account)
- [A supplier asks us to change their bank details. How do we check it is genuine?](https://netsenx.com/en/faq/supplier-asks-to-change-bank-details)
- [We paid a fraudulent invoice. What should we do now?](https://netsenx.com/en/faq/we-paid-a-fraudulent-invoice-what-now)