Article summary: QR code phishing, known as “quishing,” hides a malicious link inside an image instead of clickable text, which lets it slip past email filters built to catch suspicious URLs. The scan also pushes the victim onto their phone, a device that usually has weaker protection than a company laptop. Small teams can close this gap with a short set of habits and the same verification instincts they already use for suspicious links.
An employee opens what looks like a routine HR email: a new benefits enrollment notice with a QR code to “confirm your selection by Friday.”
Between meetings, she pulls out her personal phone, scans the code, and lands on a convincing copy of the company’s benefits portal. All she has to do is sign in.
That is what makes QR code phishing, or “quishing,” difficult to spot. Instead of displaying a suspicious link in the email, the destination is hidden inside an image and often opened on a mobile device with different security protections.
For small teams, that shift from a company-managed laptop to a personal phone can create a security gap that traditional cybersecurity awareness and email protections may not fully address.
Why QR Codes Are the Perfect Blind Spot
QR code phishing takes advantage of two security gaps that make these attacks harder to spot.
The link hides from your email filters
With a typical phishing email, the malicious link appears directly in the message. A QR code hides that destination inside an image, which can make it harder for traditional email security tools to detect before the message reaches an employee.
The Canadian Centre for Cyber Security warns that scanning a QR code can trigger actions such as opening a website, downloading an app, or joining a Wi-Fi network. It recommends configuring devices to ask for permission before launching the action, giving users a chance to verify where the code is taking them.
The scan moves the attack to a weaker device
QR codes can also move the interaction away from a company computer and onto a personal mobile device. That matters because personal phones may not have the same security controls as company-managed devices, giving phishing attempts another way around the protections businesses rely on.
What QR Code Phishing Looks Like in a Small Business Inbox
QR code phishing often hides behind familiar requests that employees are used to seeing:
- A fake invoice or vendor notice asking the recipient to scan a QR code to view a document rather than opening an attachment.
- A message impersonating IT or HR that asks employees to scan a code to update or re-enrol in multi-factor authentication.
- A fraudulent QR code placed over a legitimate one on a poster, parking meter, or payment sign, directing users to a convincing fake payment page.
QR codes have become a much more common phishing tactic in recent years. Keepnet reports that QR codes accounted for just 0.8% of phishing payloads in 2021, rising to 12.4% in 2023. In 2025, QR codes appeared in 12% of phishing attacks.
The numbers show how quickly quishing has moved from a relatively uncommon tactic to an established phishing threat.
QR code scams are already showing up in Canada.
The Canadian Anti-Fraud Centre reports that scammers posing as service providers, government agencies, and financial institutions are using QR codes to steal personal information or money.
Closing the Gap: Practical Steps for Small Teams
Reducing QR code phishing risk does not require an enterprise security budget. A few practical habits and basic mobile controls can make a difference.
- Treat unexpected QR codes like suspicious links. If an email asks you to scan a code to sign in, make a payment, or provide sensitive information, verify the request before continuing.
- Stick with your phone’s built-in camera or an approved scanning tool. Avoid downloading an unfamiliar QR scanner simply to open a code.
- Check the destination before opening it. If your phone displays a URL preview, look closely at the domain and make sure it matches the organization you expect.
- Apply basic security controls to phones used for work. Mobile device management can help enforce authentication requirements, manage work data, and remotely lock or wipe managed devices if necessary.
- Include QR codes in phishing training. Teach employees to treat an unexpected QR code the same way they would a suspicious link: pause, verify the sender, and check the destination before taking action.
A structured, enforced approach to security awareness works best when training is reinforced by practical security controls, especially as phishing tactics such as malicious QR codes continue to evolve.
What Canadian Guidance Recommends
Canada’s Get Cyber Safe program advises against scanning unexpected QR codes in emails or texts unless you can confirm they are legitimate. It also recommends keeping QR codes containing personal information in a secure folder rather than leaving them exposed in photos or screenshots.
The Canadian Centre for Cyber Security recommends configuring devices to ask for permission before launching an action from a QR code, such as opening a link or downloading an app.
These precautions build on the same habits businesses already use to defend against phishing. QR code phishing is another variation of a familiar threat, much like AI-generated business email compromise has made familiar scams more difficult to identify at a glance.
Is Your Team Ready for the Next Quishing Attempt?
Quishing works because it puts a different spin on a familiar phishing tactic, making suspicious links harder for both employees and some security tools to spot. Closing that gap means extending the protections you already have to include QR codes and the mobile devices used to scan them.
Haxxess can help your team review mobile security policies, strengthen phishing awareness training, and make sure QR-based attacks are covered before one turns into a real security incident.
Call us at 705-222-8324 or contact us here to get started.
Article FAQs
What is quishing?
Quishing is a form of phishing where the malicious link is hidden inside a QR code image rather than typed out as text. Because the destination is not visible until the code is scanned, it can bypass email security tools built to detect suspicious URLs.
Why are QR code scams more dangerous on mobile devices?
QR codes are almost always scanned with a smartphone camera, pulling the interaction away from a monitored work computer and onto a personal device with fewer security controls in place. That shift removes a layer of protection the business would otherwise have.
How can a small business train employees to spot quishing attempts?
Extend existing phishing awareness training to cover QR codes, since most programs only address text-based links. Employees should treat an unexpected QR code with the same caution as an unfamiliar link and check the previewed destination before continuing.
