A QR code phishing email asks you to scan a code, usually to "re-verify" an account, sign a document or reset a password. Attackers use QR codes because email filters can struggle to read the link inside an image, and because scanning moves you to your phone, where fake login pages are harder to spot.
Phishing has existed for as long as email, but the QR code variant, often called quishing, is a newer twist. Instead of a blue link you can hover over, there is a square image. This guide explains why attackers like this method, what these emails typically look like, and what both employees and companies can do to protect themselves.
Why attackers put QR codes in emails
From a criminal's point of view, a QR code solves several problems at once.
- It hides the link. People cannot read a QR code, so they cannot spot a suspicious web address at a glance.
- It can slip past filters. Many email security tools check text links against lists of known bad sites. A link inside an image is harder to inspect, although modern tools increasingly scan images too.
- It moves you to another device. You read the email on a work laptop protected by company security, but you scan with a personal phone that may have fewer protections.
- Small screens hide details. On a phone, the address bar is short, and a fake login page looks much like the real one.
- It feels modern and official. QR codes are used by banks, airlines and employers, so a code in an email does not automatically raise suspicion.
What a QR phishing email looks like
These emails vary, but they usually follow familiar patterns. Common themes include:
- "Your password expires today. Scan to keep your current password."
- "Multi-factor authentication must be re-enabled. Scan with your phone."
- "You have a shared document waiting. Scan to view."
- "Your salary or bonus details have been updated."
- "A parcel or invoice requires your confirmation."
Typical warning signs:
- Urgency: a short deadline or a threat that your account will be locked.
- An odd sender: the display name says "IT Support" or a well-known brand, but the email address does not match.
- Little text, big code: the message is mostly an image with a QR code and a short instruction.
- Generic greetings instead of your name.
- A login page after scanning: the code leads to a page asking for your work email and password, or for a one-time code.
The last point matters most. A genuine IT department rarely needs you to sign in through a QR code sent by email.
What to do if you receive one
If you are an employee and a suspicious QR code email arrives:
- Do not scan it with your phone.
- Do not forward it to colleagues to ask if it is real, as someone might scan it.
- Report it using your company's phishing report button or by contacting IT through a known channel.
- Check the account yourself. If the email mentions your password or a document, go to the service directly through its usual address or app.
- Delete it once reported, if your company's process says so.
If you have already scanned the code and entered your details, act quickly. Change your password, tell IT straight away, and follow the steps in our guide on what to do after you scanned a malicious QR code.
Outside of work, the same habits apply. If you want to know where a code leads without opening it, a scanner that shows the destination first, such as the QR-TH online QR scanner, lets you look before you click.
How companies protect staff
No single tool stops every QR phishing attempt. Good protection combines technology, process and people.
Email and security tools
- Use email security that can detect QR codes in images and attachments and check the links they contain
- Keep link checking and safe-browsing protection active on company devices and, where appropriate, on managed phones
- Flag emails from outside the organisation clearly, especially those using internal-sounding names
Strong sign-in protection
- Require multi-factor authentication for all staff accounts
- Prefer phishing-resistant methods, such as passkeys or security keys, where possible, since one-time codes can still be tricked out of people on a fake page
- Encourage authenticator apps over text messages. Our guide to two-factor authentication explains the options.
- Monitor for unusual sign-ins, such as logins from new countries or devices
Clear processes
- Make it a known rule that IT will never ask staff to sign in through a QR code in an email
- Provide one simple way to report suspicious messages, and thank people who use it
- Have a plan for quickly resetting passwords and ending sessions when someone reports a mistake
Training that sticks
- Show real-looking examples of QR phishing emails in training
- Teach the simple question: "Why would this need a QR code?"
- Run phishing simulations that include QR codes, followed by friendly feedback rather than blame
Staff who feel safe reporting mistakes report them faster, which limits the damage.
Legitimate QR codes in emails
Not every QR code in an email is malicious. Event tickets, boarding passes and some login pairings legitimately use them. The difference is usually context: you expected the email, it relates to something you did, and the code is something you show or use in a known app, not a reason to type your password on an unknown page.
Businesses sending genuine QR codes can help by explaining what the code does, keeping a recognisable link nearby as an alternative, and using trusted domains.
FAQ
Why do phishing emails use QR codes instead of links?
Because the link is hidden from both people and some filters, and because scanning moves the victim to a phone, where security controls and visual clues are often weaker.
Can my email provider block QR code phishing?
Many email security services now scan images for QR codes and check the links, but none catch everything. Your own caution is still an important layer.
Is it safe to scan a QR code in an email from my bank?
Be cautious. Banks rarely ask you to sign in through a QR code in an email. Open the bank's official app or type its address yourself instead.
What should I do if I entered my work password after scanning?
Change the password immediately, tell your IT or security team, and let them check for suspicious sign-ins. Speed makes a real difference.
Look before you open
QR phishing works when people scan without thinking. Make checking a habit: when an unexpected code arrives, use the QR-TH scan a QR code online tool to see where it goes before you open anything.