The parking meter in the garage on Fifth Avenue looked entirely normal. The QR code sticker was neatly placed, the signage around it was professional, and the instructions made sense: “Scan to pay.” He scanned it. His phone opened a page that looked exactly like PayPal — same layout, same blue, same font. He entered his card number, his expiration date, his CVV. The page thanked him for paying and redirected him to a blank screen. His car got a ticket two hours later. The meter had never been connected to his payment.
By the time he noticed unauthorized charges on his card the following morning, the card details had already been sold twice on a Telegram channel that trades in fresh dumps. The original QR code on that meter had been covered with a sticker. The sticker was placed there sometime the previous night. It took about thirty seconds.
This is quishing — QR code phishing — and it has moved far beyond parking garages. It lands in your email inbox as a Microsoft account verification request. It sits on the table at a restaurant next to the salt shaker. It arrives as a text message about a missed package delivery. The QR code looks legitimate. It might be sitting right next to something legitimate. And your phone almost certainly won’t warn you before it opens the page.
The short answer. Quishing is phishing that hides the malicious link inside a QR code. It works because email filters read text, not the pixels in an image, so a QR code slips straight past them. Check Point logged a 587% surge in these attacks in 2023. Once you scan, your phone opens a fake login or payment page that steals your credentials or card details. Before you scan, check the source: don’t scan a code on a sticker, an unexpected email, or a random text. After you scan, read the full URL before typing anything, and never enter a password or card number on a page you reached only by scanning a code.
What a QR Code Actually Is — and Why That Matters
A QR code (Quick Response code) is nothing more than a machine-readable encoding of a string of text. In practice, that text is almost always a URL. When your phone’s camera reads the black-and-white pattern of squares, it decodes the URL and, in most cases, opens it immediately in your browser. There is no preview by default on most devices. There is no warning. You scan, you click, you’re there.
The encoding itself has no built-in verification. A QR code doesn’t know whether the URL it contains leads to your bank or to a server in a data center registered yesterday under a name designed to look like your bank. The code is just a picture of a string. That’s all it has ever been.
Attackers figured out a specific structural advantage in this: your email security software does not read pictures the way it reads text.
The Reason Quishing Exploded in Corporate Environments
When a phishing email contains a link — say, https://microsofft-account-verify.com/login — enterprise email security gateways like Proofpoint, Mimecast, and Microsoft Defender for Office 365 scan that URL. They check the domain’s reputation. They may follow the link to see what’s on the other side. They compare it against known threat intelligence databases. If the link looks malicious, the email is flagged, quarantined, or rewritten with a warning.
A QR code embedded in an email is a .png image. The link inside it — the actual malicious URL — is encoded in the pixel pattern. Email security tools in 2023 and into 2024 could not read those pixels. They saw an image attachment. They passed the email through.
This is not a subtle vulnerability. Attackers identified it explicitly and built campaigns around it. By embedding a QR code in a phishing email instead of a hyperlink, they could reliably bypass corporate email security that had become extremely effective at catching traditional phishing links. The corporate email gateway — the tool your IT department pays thousands of dollars a month for — became irrelevant for any phishing email that used a QR code.
The numbers reflect how quickly attackers exploited this. Check Point’s Harmony Email team recorded a 587% surge in quishing attacks between August and September 2023. Egress separately found that QR codes jumped from under 1% of phishing attacks in 2021 to around 12% by 2023. That is not a gradual trend. It is a deliberate pivot by threat actors who recognized that QR codes offered a direct path around the security layer that had been closing off traditional phishing.
Microsoft 365 Is the Primary Target — and Here’s Why
In the vast majority of corporate quishing campaigns, the fake page at the end of the QR code is designed to harvest Microsoft 365 credentials. Not Google accounts. Not bank logins. Microsoft 365 first.
This is rational targeting. A single Microsoft 365 username and password gives an attacker access to your Outlook email, your OneDrive files, your SharePoint documents, and your Teams conversations. It often opens your organization’s VPN too, if that VPN uses Azure Active Directory for authentication. One credential. Everything.
Microsoft 365 credentials also sell well. They’re valuable for direct exploitation and for business email compromise (BEC) fraud. In a BEC attack, criminals read your email for weeks to learn payment flows, then impersonate a vendor or executive to redirect a wire transfer. The FBI’s Internet Crime Complaint Center (IC3) reported over $2.77 billion in BEC losses in 2024, and compromised Microsoft 365 accounts are the most common entry point. For the full mechanics, see the guide to business email compromise.
The phishing page itself is usually a convincing replica of the Microsoft 365 sign-in portal. Attackers use stolen HTML and CSS, or purpose-built kits that are sold on dark web forums for a few hundred dollars. Some kits include real-time credential relay. When you type your password on the fake page, the attacker’s server immediately tries it on the real Microsoft login. It even passes through your multi-factor authentication prompt, relaying it to you in real time. You enter your MFA code on the fake page. The attacker uses it on the real one. This is called an adversary-in-the-middle (AiTM) attack, and MFA does not stop it.
How Attackers Host the Fake Page — and Why It’s Hard to Detect
If you saw a URL like https://microsoftlogin-verify.attacker.net, you’d probably hesitate. Attackers know this. The techniques they use to host and obscure the destination have become increasingly sophisticated.
Redirector chains. The QR code doesn’t link directly to the phishing page. It links to a first-stage redirector — often a legitimate URL shortener or a compromised website. That page redirects to a second-stage URL. Some campaigns use three or four hops before delivering the actual credential-harvesting page. Each hop makes automated detection harder, because the first URL in the chain may have a clean reputation.
Legitimate hosting platforms. Attackers host phishing pages on Google Sites, GitHub Pages, Microsoft SharePoint, and Cloudflare Pages. These platforms have clean IP reputations. Security tools that block domains based on reputation won’t block sites.google.com or sharepoint.com. The phishing page is just content hosted on a trusted platform. Some phishing kits specifically target the SharePoint hosting trick because a Microsoft-branded phishing page hosted on Microsoft infrastructure looks exceptionally convincing.
CAPTCHA gating. Many modern phishing pages are protected by a CAPTCHA challenge. This isn’t about verifying you’re human — it’s about preventing automated security scanners from reaching the phishing content. A security tool that follows a link to check its content sees only a CAPTCHA page and classifies the site as benign. You solve the CAPTCHA, and the phishing page loads. This is now standard practice in higher-quality phishing kits.
Geo-fencing. Some campaigns only serve the phishing page to visitors from specific countries or regions. Automated scanners running from cloud infrastructure in data centers outside the target region see nothing suspicious.
The FBI Warning About Parking Meter Attacks
In January 2022, the FBI’s Internet Crime Complaint Center issued a public service announcement specifically about QR code fraud, with particular attention to physical QR code stickers placed on parking meters. The warning noted that criminals were placing malicious QR codes over legitimate ones to redirect payments to attacker-controlled sites, and that victims had no way to distinguish the fraudulent code from the original without physical inspection.
The FBI warning was not hypothetical. Cities including Austin, Texas, San Antonio, and cities across the UK reported confirmed incidents of parking meter QR sticker fraud within months of one another in early 2022. The attacks followed a consistent pattern: stickers printed to match the look and feel of the legitimate meter signage, placed over the original QR code, linking to payment pages designed to capture card details.
The same physical sticker technique has since been documented at restaurants (placed over table QR codes that link to menus), at EV charging stations, at airport luggage carousels, and on event signage. Any physical QR code that exists in public space is a potential target. The sticker takes seconds to place and may sit on a high-traffic location for days before anyone notices.
The Four Campaign Types You’ll Actually Encounter
Understanding how quishing works in practice means understanding the specific scenarios where you’re likely to encounter it.
Physical sticker attacks are exactly what the FBI described. A fraudulent sticker is placed over a legitimate QR code in a public space. The sticker itself is often a professional-quality print — it doesn’t look like something made at home. The goal is payment credential theft. These attacks work because we’ve been conditioned to trust QR codes in commercial environments. The meter looks real. The restaurant table looks real. The code is a sticker over a sticker, and you can’t tell from arm’s length.
Email quishing campaigns target corporate employees. The email looks like a routine Microsoft notification — “Your account requires re-verification,” or “Unusual sign-in activity was detected,” or “Your password expires in 3 days.” The body of the email contains a QR code instead of a link. The instruction says: “Scan the code with your phone camera to verify your account.” The reason for this instruction is explicit: the attacker wants you on your phone, which doesn’t have your company’s security software installed. Your corporate laptop might have endpoint detection, DNS filtering, and browser extensions that would flag the phishing domain. Your personal phone almost certainly doesn’t.
Package delivery scams arrive by SMS or email. A message claims a package couldn’t be delivered — from FedEx, UPS, DHL, Royal Mail, India Post, or another carrier. The QR code supposedly lets you reschedule delivery. It leads to a page harvesting either your address and card details (ostensibly for a redelivery fee) or your carrier account credentials. Delivery scam volume spikes around major shopping periods — Black Friday, the holiday season, Diwali, Amazon Prime Day.
Cryptocurrency bonus scams promise free tokens, trading bonuses, or exchange rewards in exchange for scanning a QR code. These redirect to wallet-draining smart contract approvals or seed phrase harvesting pages. The QR codes circulate on Twitter/X, Reddit, Telegram, and Discord.
The Redirector Chain in Practice
Walk through what actually happens when you scan a quishing QR code in a corporate phishing email. The QR code encodes a URL that looks like this: https://forms.office.com/something/randomstring. That’s a real Microsoft domain. The email security gateway sees an image. The link encoded in the image leads to a Microsoft-controlled domain. Nothing is flagged.
You scan the code. Your phone opens forms.office.com. Microsoft Forms is a real product. Attackers have built a form that contains an embedded link disguised as a button: “Click here to verify.” That click takes you to a redirector page on a compromised WordPress blog in Eastern Europe. From there, you’re redirected to a Cloudflare Pages URL. From there, to the actual phishing page. It is a replica of the Microsoft 365 login that captures your credentials in real time and relays them to the attacker.
At no point in this chain did a malicious-looking URL appear in an email. The email contained an image. The image encoded a Microsoft URL. The rest happened after you made the choice to scan.
How to Inspect a QR Code Before Opening It
This is the part that matters. Your phone’s camera decodes QR codes automatically, and in most cases opens the URL without giving you a chance to check it. But you have options.
On iPhone (iOS 11 and later): When you point your camera at a QR code, a notification banner appears at the top of the screen. That banner shows you the URL before you tap it. Read the full URL in that banner. Do not tap yet. Check what’s there.
On Android: The default behavior varies by manufacturer and Android version. Google Lens, which ships on most Android devices, shows a URL preview before opening it. If you’re using a dedicated QR scanner app, choose one that shows you the full URL before opening it rather than redirecting immediately.
On both platforms: You can also use a dedicated QR code reader app like “QR & Barcode Scanner” by Gamma Play or similar tools that explicitly show the destination URL and wait for your confirmation before opening it. This adds one extra step and one extra chance to catch a fraudulent destination.
How to Tell if a Physical QR Code Has Been Tampered With
For QR codes on physical objects — parking meters, restaurant tables, event signage, charging stations — the inspection is tactile as much as visual.
- Run your finger across the code. If a sticker has been placed over the original, there will often be a raised edge you can feel. The original QR code is usually printed directly on the surface or is a flat, flush sticker. A fraudulent overlay has a second layer.
- Look at the edges under light. At an angle, you can often see the edge of a sticker placed over another surface. The overlay may not sit perfectly flush.
- Check for alignment. Fraudulent stickers are placed by hand and are sometimes slightly off-center relative to the signage around them. If the QR code looks like it’s slightly tilted or shifted within its designated box, that’s worth checking.
- Look for print quality differences. The fraudulent sticker may have a different sheen, texture, or color tone than the surrounding signage. It may look slightly too glossy or slightly too matte.
- Check for a URL printed alongside the code. Many legitimate QR codes on commercial signage have the destination URL printed in small text below or beside the code. If the printed URL and the scanned URL don’t match, stop.
If you’re at a parking meter and anything about the QR code looks off, use the meter’s keypad or phone number instead. For restaurant menus, ask the server for a physical menu or look up the restaurant’s menu directly on their website.
Checking the URL After Scanning — What to Actually Look For
Even if your phone shows you the URL before opening it, you need to know what a fraudulent domain looks like.
Attackers rely on several techniques to make the URL appear trustworthy at a glance.
Typosquatting. The domain is a misspelling of the legitimate one: pay-pa1.com instead of paypal.com, microsofit.com instead of microsoft.com, amazon-support.com instead of amazon.com. When you’re reading a URL quickly on a small phone screen, transposed letters and substituted numbers (1 for l, 0 for O) are easy to miss.
Subdomain tricks. The URL is structured so the legitimate brand name appears at the start, making it look real: paypal.com.account-verify.net. The actual domain here is account-verify.net. Anything before the last two segments of the domain (before the final .com, .net, .org) is a subdomain controlled by whoever registered account-verify.net. paypal.com appears in the URL but has nothing to do with PayPal.
Legitimate platform hosting. As described above, the URL might genuinely be sites.google.com, sharepoint.com, or github.io. A real domain doesn’t mean a safe destination.
Lookalike Unicode characters. In internationalized domain names, visually identical Unicode characters can substitute for ASCII letters. аррlе.com (using Cyrillic а and р) can look identical to apple.com on screen. These attacks are rarer but documented.
The rule: read the domain, not the subdomain. Find the last dot before the path, count back two segments, and verify that’s the organization you expect. account.microsoft.com/path — the domain is microsoft.com, that’s legitimate. microsoft.com.verify-account.net/path — the domain is verify-account.net, that’s not Microsoft.
What Businesses Should Do
If you manage security for an organization, quishing requires specific countermeasures beyond traditional email security.
Most major email security vendors added QR code scanning capability in 2024 in response to the quishing surge. Microsoft Defender for Office 365, Proofpoint, and Abnormal Security all announced QR code detection features. Check whether your current version and configuration has this enabled — it is not always on by default.
Beyond email scanning, the structural problem is that corporate phishing emails are designed to route employees to their personal phones. The answer isn’t just better email scanning; it’s ensuring that the devices employees use to scan QR codes have equivalent protection. Mobile Device Management (MDM) solutions can enforce DNS filtering and browser security on enrolled personal devices.
Training matters here more than in most phishing scenarios, because the technical detection layer was genuinely absent for years. Employees who learned to hover over links to check URLs before clicking never developed an equivalent habit for QR codes, because QR codes didn’t used to be a phishing vector. That habit needs to be explicitly taught.
Finally: any internal process that requires employees to scan a QR code in an email is a process worth redesigning. Legitimate internal systems should not require QR code scans for authentication. If your IT department sends verification emails, those emails should contain links — not QR codes — so that security tools can inspect them.
A Pre-Scan Checklist
Before you scan any QR code — on a parking meter, a table, a package, or in an email — run through these checks.
- Did you expect this QR code? If a QR code arrived in an email you weren’t expecting, or appeared in a context that doesn’t make sense, don’t scan it.
- Inspect the physical code. Run your finger over it. Check the edges under light. Look for alignment issues or print quality differences suggesting a sticker over a sticker.
- Preview the URL before tapping. On iPhone, read the banner. On Android, use a scanner app that shows URLs. Do not tap open automatically.
- Read the actual domain. Find the last two segments before the first
/in the path. That’s the real domain. Is it the organization you expect? - Check for subdomain tricks. If a brand name appears early in the URL but the domain itself is different, it’s fraudulent.
- Never enter payment or login credentials on a page reached via an unexpected QR code. If you need to pay for parking, use the meter’s physical controls or call the posted phone number. If you need to verify a Microsoft account, open your browser and navigate to microsoft.com directly.
- If in doubt, use the official app. For banking, payments, and email, open the official app for that service rather than following any QR code.
The parking garage attacker spent thirty seconds placing a sticker. The fraudulent PayPal page looked exactly right. Nothing in the flow felt wrong until the next morning. The QR code was the entire attack surface — and the defense against it is simply slowing down for ten seconds before your phone loads whatever that picture is pointing at.
KnytX Shield is built to scan data broker databases, submit removal requests on your behalf, and watch dark web sources for your exposed credentials. Once it launches, if your email or passwords from a previous breach are circulating in stealer logs or credential dump files, it’s designed to surface that before it becomes an account takeover. It isn’t live yet; join the waitlist to get in early.