QR codes are part of normal business now. You scan them for a menu, to pay for parking, to connect to WiFi, to open a shared document. Attackers know that, and they’ve started hiding malicious links inside QR codes specifically to get past the security tools that would normally catch a bad link in an email.
The technique has a name: quishing. It works because a QR code is just an image. Your email filter reads text. A link encoded into a picture passes straight through. When you scan it, you usually do it on your phone, which sits outside most of the protection your work computer has.
What a QR Code Scam Actually Is
It’s a phishing attack that swaps a written link for a QR code. Instead of a clickable URL your email security can inspect, the attacker encodes the address into a square image. You scan it with your phone camera, your phone opens the link, and you land on a page built to steal a login or payment details.
The page itself is the same kind of fake you’d see in any phishing attempt: a login screen dressed up as Microsoft 365, or a payment form copying your bank. The QR code is only the delivery method that gets you there.
Why It Gets Past Your Security
Two things make it effective. First, the link hides inside an image. Most email security scans text for known bad links, and a QR code isn’t text a filter can read.
Second, scanning moves you onto your phone. Your work computer likely has web filtering, endpoint protection, and DNS controls that block known bad sites. Your personal phone usually has none of that, so the moment you scan, you’ve stepped outside the protection your business is paying for, often without realizing it happened.
How Common This Has Gotten
Microsoft’s report on email threats for the first quarter of 2026 detected roughly 8.3 billion phishing attempts in three months. QR code phishing specifically rose 146% across the quarter, from 7.6 million attacks in January to 18.7 million in March, its highest monthly volume in at least a year.
Most of these arrive as PDF attachments. The QR code sits inside the PDF, the PDF is attached to an ordinary-looking email, and the whole thing passes for a normal document until someone scans it.
What These Scams Look Like
A few patterns show up repeatedly. A “security” email claiming to be from Microsoft or your IT provider, asking you to scan a code to re-enroll MFA or keep your account active. A shared-document notice saying a colleague sent a file, with a code to view it. A fake invoice with a QR code “to pay faster” that routes the payment to the attacker instead. A missed-delivery text asking you to scan a code to reschedule. And in the physical world, stickers placed over legitimate codes on parking meters and payment terminals.
How to Protect Your Business
Treat a QR code in an email with the same suspicion as a strange link, especially one asking you to log in or pay. Before acting, check the web address your phone shows once it opens the code. If it’s not the site you expected, close it.
When in doubt, go direct instead of scanning. Open your browser and type the address yourself, or use a bookmark, rather than trusting the code to take you to the right place. Be wary of urgency; a message threatening account closure “within 24 hours” is designed to move you faster than your judgment.
Phishing-resistant MFA, a passkey, a hardware key, or number-matching in an authenticator app, limits the damage if a password does get captured. And for physical codes, a quick look for a sticker placed over the original catches the low-tech version of this attack.
Most people have never been warned about this specifically. A short message to your team with a real example of what one of these looks like does more good than any policy document.
If Someone Already Scanned One
Change the password on that account immediately, along with any other account using the same one. Confirm MFA is on. Tell whoever manages your IT so they can check for unusual sign-ins. If banking or card details went in, call the bank and watch the account closely.
Acting within the first hour limits what an attacker can actually do with what they captured. If you want help putting together a quick reference your team can use to spot these, we’re happy to build one.