QR-Code Phishing (Quishing): How to Protect Your Employees and Your Accounts

QR-code phishing, often called "quishing", hides a malicious link inside a QR code instead of a clickable URL. The code shows up in an email, a PDF attachment, a fake invoice or a sticker placed over a real parking or payment code, and when someone scans it with a phone they land on a fake sign-in or payment page. It works because the link is an image that many email filters were not built to read, and because the victim finishes the attack on a personal phone instead of the protected work computer. The fix is a mix of simple employee rules, email filtering that reads QR codes, protection on the phones that access company data, and an easy way to report what looks wrong.

What QR-code phishing looks like at work

The FBI has warned about tampered QR codes since its January 2022 public service announcement, which described criminals replacing legitimate codes, both digital and physical, with codes that lead to sites asking for login and financial information. The FTC issued a similar consumer alert in December 2023, noting scammers covering parking meter codes with their own and sending QR codes by email and text.

In an office, the lures usually look like routine work:

• "Your MFA is expiring, scan to re-register." A message that looks like it comes from IT or Microsoft 365 asks staff to scan a code to keep their account active.
• Shared document or voicemail notices. "You have a new secure file" or "Missed voicemail, scan to listen", with the code as the only link.
• Invoices and payment requests in PDFs. A PDF attachment with a "pay by QR" box, which moves the payment to an account the criminals control.
• HR and benefits messages. Open enrollment, payroll updates or a "new policy to sign".
• Physical stickers. A sticker over the code on a parking meter, a shared office printer, a conference badge or a restaurant table near the office.

Why it gets past defenses

There are three reasons quishing works:

1. The link is an image. A traditional filter looks for clickable URLs in the text. A QR code is a picture, so older tools may not see the destination at all.
2. It moves to a phone. In its January 2026 FLASH alert about North Korea's Kimsuky group, the FBI explained that forcing targets to scan with a mobile device sidesteps the email security controls on the work computer. Phones often lack the same web filtering, and a small screen makes a fake address harder to spot.
3. It can defeat ordinary MFA. The same FBI alert notes that quishing often leads to the theft and replay of session tokens. The fake page relays the real sign-in, MFA code included, and keeps the session that results. That is why a standard text or app code does not fully protect against this kind of page.

Rules every employee can follow

Short, specific rules beat long lectures. These are adapted from the FBI and FTC guidance:

1. Do not scan QR codes in unexpected emails, texts or PDFs, especially ones that say something is urgent. Treat a QR code in an email exactly like a link.
2. IT will never ask you to scan a code to keep MFA or your password working. Put that sentence in writing. If you see a request like this, report it.
3. Check the address after scanning and before tapping. Most phone cameras show a preview of the website. If the domain is misspelled, unfamiliar or a link shortener, stop.
4. Never type your work password or MFA code into a page you reached from a QR code unless you are sure it is genuine. Instead, open the app or type the company's known address yourself.
5. Do not pay through a QR code on an invoice or a payment notice. Verify the request by calling a phone number you already have on file.
6. Look at physical codes before scanning. A sticker placed over another code is a red flag.
7. Do not install apps from a QR code. Use the official app store, and do not download third-party QR scanner apps; the built-in camera works.
8. Report it. Use the report button in your email client, or forward a screenshot to IT.

If your team already knows the phishing red flags every employee should know, add one line to that list: a QR code is a link, and the same rules apply.

Email filtering that reads QR codes

Make sure your email protection can read the images in a message, not just the text. Some providers now do this. Microsoft, for example, has described how Defender for Office 365 extracts URLs hidden in QR code images early in mail flow so they can be analyzed like any other link. Ask your provider, or your IT partner, three questions:

• Does our filter extract and check URLs from QR codes in the message body and in attachments such as PDFs?
• Are those URLs checked again when someone visits them, not only on delivery?
• Can we see QR-code detections in our reports?

Also review the basics: anti-phishing and impersonation protection, the Microsoft 365 security settings every small business should turn on, and external sender tags so staff notice when a "message from IT" actually came from outside.

Protecting the phones that touch company data

Because the attack finishes on a phone, the phone needs some protection too:

• Manage devices that access company email and files. With Microsoft Intune or a similar mobile device management tool you can require a screen lock, an up-to-date operating system and, where available, mobile threat protection that checks web links. For staff using their own phones, see our Intune BYOD policy guide.
• Keep phone operating systems and browsers updated. The FTC lists this among its basic recommendations.
• Use conditional access. Require compliant or managed devices for access to company data, so a stolen password alone is not enough from an unknown phone.

Phishing-resistant MFA: the strongest fix

The FBI recommends phishing-resistant MFA for remote access and sensitive systems. Passkeys and FIDO2 security keys are tied to the real website, so a fake page reached through a QR code cannot use them. If you have not started yet, our guide to multi-factor authentication for business explains the options, and number matching in authenticator apps is a useful interim step.

Make reporting easy and judgment-free

The fastest way to learn about a quishing wave is an employee who reports it. Turn on the built-in report button in Outlook or the report option in Gmail, tell people what happens after they report, and thank them every time, including when the message turns out to be harmless. If someone did scan a code and enter a password, they should tell IT immediately; the right response is to reset the password, revoke active sessions and check sign-in logs, not to blame the person.

A quick checklist

• One-page QR rule sheet shared with staff, in English and Spanish
• Written statement that IT never asks staff to scan a code for MFA or passwords
• Email filtering that reads QR codes in bodies and attachments
• Managed, updated phones for anyone who accesses company data
• Phishing-resistant MFA for admins and remote access first
• Report button enabled and a clear "I scanned it, now what?" procedure

QR codes are convenient and here to stay; the goal is not to ban them but to treat them like any other link. If you would like help checking your email filtering, mobile device management and MFA setup, request a free IT assessment. Core Florida IT works with businesses across Miami-Dade and South Florida, in English and Spanish.

Sources

• Cybercriminals Tampering with QR Codes to Steal Victim Funds (FBI IC3, I-011822-PSA)
• North Korean Kimsuky Actors Leverage Malicious QR Codes in Spearphishing Campaigns Targeting U.S. Entities (FBI FLASH, January 8, 2026)
• Scammers hide harmful links in QR codes to steal your information (FTC Consumer Alert)
• How Microsoft Defender for Office 365 innovated to address QR code phishing attacks (Microsoft Security Blog)
• More than a Password: multifactor authentication (CISA)