Quishing: How QR Code Phishing Scams Work and How to Protect Yourself

Quishing, a phishing technique using QR codes to hide malicious URLs, has increased significantly with QR codes appearing in approximately 11% of phishing emails analyzed in the first half of 2026. The scam directs victims to fake login pages or malware downloads after scanning. Unlike traditional phishing, the destination remains invisible until the code is scanned, making it harder to detect.

What is Quishing?

Quishing is a portmanteau of "QR" and "phishing" that refers to a scam technique using QR codes to hide malicious URLs. Attackers send emails containing QR codes and urge recipients to scan them.

How the Scam Works

According to ESET Latinoamérica's research, approximately 11% of phishing emails in the first half of 2026 contained QR codes. After scanning, victims may be directed to:

Fake login pages
Fraudulent payment screens
Downloads of malicious applications
Unauthorized actions within legitimate apps

ESET's report found the highest detection rates in the United States (19%), Spain (17%), and Mexico (6%).

Key Differences from Traditional Phishing

The primary danger of QR codes is that the destination URL remains invisible until scanning occurs. While text URLs can be read and scrutinized before clicking, QR codes hide their destination in white and black patterns that are imperceptible to the human eye.

Moreover, as ESET Latinoamérica researcher Jonathan Ramos notes, attackers deliberately shift interaction from "relatively protected environments" like work computers to "smartphones that often lack the same security measures." Most mobile devices have fewer security protections than computers, making attacks more likely to succeed.

Prevention Tips

Scan Cautiously and Verify URLs Always check the URL displayed by your QR code reader to ensure it matches the expected website before proceeding. If suspicious, do not open it.

Prioritize Official Channels For invoices, shipments, benefits, or transactions, visit the official website directly or use the official app rather than following QR code links from emails.

Review Information Before Confirming Actions Before entering any data, especially payment details or login credentials, carefully verify all information displayed on the page.

Avoid Installing Apps from Unknown QR Codes Download applications exclusively from official app stores (Apple App Store or Google Play Store). Never install applications by scanning QR codes from untrusted sources.

Verify Through Official Channels When in Doubt If you're uncertain about a QR code's legitimacy, contact the organization directly using verified contact information from their official website.

Keep Your Device Updated and Protected Maintain your smartphone's operating system at the latest version and install reputable security software.

If You've Already Scanned a Suspicious QR Code

If a suspicious page opens after scanning, close it immediately without entering any information. If there's a risk that credentials or payment information was compromised, consider changing passwords for affected accounts and contacting your card issuer.