Article Summary: A QR code scam, sometimes called quishing, hides a malicious web link inside a QR code. Because the link is buried in an image instead of written as text, it slips past the email filters that normally catch bad links, and scanning the code usually moves the victim onto a personal phone that sits outside the company’s security. Microsoft reported a 146% rise in QR code phishing during the first quarter of 2026.
QR codes are part of normal business now.
You scan them to see a menu, pay for parking, connect to Wi-Fi, or open a shared document.
Attackers know that, and they have started hiding malicious links inside QR codes to get past the security tools that would normally catch a bad link in an email.
The technique has a name, quishing, and it works because a QR code is just an image.
Your email filter reads text, so a link encoded into a QR code can pass straight through. When you scan it, you usually do so on your phone, which sits outside most of the protection your work computer has.
This post covers what a QR code scam is, why it gets past your security, what the common ones look like, and the habits that protect your business.
A QR code scam is a specialized phishing attack that replaces a standard text URL with a quick-response image code. Instead of providing a clickable link that traditional email security systems can inspect, the attacker embeds the destination link within a square pixel matrix.
When employees scan the image using a smartphone camera, the device immediately processes the link and routes them to a fake webpage designed to steal login credentials or financial data.
The destination landing page mirrors traditional phishing setups, such as spoofed login screens mimicking Microsoft 365 Support or counterfeit payment gateways designed to steal banking credentials. The QR code acts simply as a evasive delivery mechanism to get users there undetected.
Two things make these scams effective.
First, the malicious link is hidden inside an image.
Most email security tools scan the text of a message for known bad links. A QR code is a picture, so the link inside it is not text the filter can read.
The UK’s National Cyber Security Centre points out that not all phishing-detection tools scan images, which is the reason criminals started using QR codes to disguise their links in the first place.
Second, scanning a code moves you onto your phone.
Your work computer probably has web filtering, endpoint protection, and DNS controls that block known bad sites.
Your personal phone usually has none of that. So the moment you scan, you step outside the protection your business pays for, often without realizing it happened.
The volume is climbing fast. In its report on email threats for the first quarter of 2026, Microsoft said it detected around 8.3 billion email-based phishing threats in those three months.
QR code phishing rose 146% across the quarter, from 7.6 million attacks in January to 18.7 million in March.
By the end of the quarter it had reached its highest monthly volume in at least a year.
Microsoft also found that most of these attacks arrived as PDF attachments, growing from 65% of QR code attacks in January to 70% in March.
The QR code sits inside a PDF, the PDF is attached to an email, and the whole thing looks like an ordinary document until someone scans it.
These are the QR code scams that come up most often.
Protecting yourself against Quishing comes down to a few habits:
If an employee scans a suspicious code and enters sensitive credentials:
Most QR codes are safe. A code on a restaurant table or an official payment terminal is usually fine. The risk comes from codes sent in unexpected emails or texts, and from stickers placed over real codes in public. Treat those with caution.
Quishing is phishing that uses a QR code instead of a written link. The word combines “QR” and “phishing.” The goal is the same as any phishing attack: to get you onto a fake page that captures your login or payment information.
Not consistently. Many legacy email security filters only evaluate written text and fail to parse images. While advanced threat protection platforms are evolving to include optical image analysis, relying solely on automated filtering is insufficient without user vigilance and comprehensive cyber security services.
A written link can be inspected by your email security and opened on a managed work computer. A QR code hides the link from those tools and pushes you to scan with your phone, which usually has far less protection than your work device.
If you closed the page without typing anything, the risk is low. Close it, don’t go back, and let your IT contact know so they can keep an eye out. If you did enter a password or payment details, follow the recovery steps above.
Disclaimer: This blog post is for informational purposes only and does not constitute legal, financial, or IT advice. For professional guidance tailored to your business, consult with Cascade IT Services or a certified Microsoft partner.
Article used with permission from The Technology Press.
