QR code scam, or quishing, uses a malicious QR code to send a person to a fake site, payment page, or login prompt. The code can hide in emails, posters, invoices, or packages. Attackers use it to steal credentials, install malware, or redirect victims to fraud and phishing infrastructure.
What a QR code scam changes in the attack path
Quishing matters because it moves the user from an apparently harmless image to an attacker-controlled destination. That breaks the usual visual cues people rely on in email, print, and packaging, and it lets the attacker separate the lure from the malicious URL until the final scan.
Because the code can be placed in messages, invoices, posters, or parcels, the same scam works across digital and physical channels. The security problem is not the code itself, but the trust that users place in the QR object before they can inspect the destination.
How quishing is used to steal credentials and deliver malware
Most quishing campaigns try to get one of two outcomes: capture a login on a fake site, or route the victim into a malicious download, payment flow, or device compromise path. In practice, the code is often just the first step in a broader phishing chain.
The attack is effective because scanning feels routine and low-friction, so victims may not notice that the scan leads outside the legitimate workflow. If the destination mimics a payment portal or identity prompt, the attacker can harvest passwords, one-time codes, or session information; if it mimics a document or app download, the result can be malware installation or credential-theft tooling.
NHIMG’s Top 10 Phishing Techniques places QR lures in the same family as other high-impact phishing methods, because the initial trust decision is what the attacker is trying to exploit.
Where QR code scams hide and why they evade review
Quishing often works in places where people expect a shortcut, such as invoices, parking notices, shipping labels, or sign-in instructions. A QR code also compresses a long URL or action into a small graphic, which makes manual review less likely and content scanning harder for some mail and document controls.
Attackers also benefit from the fact that a QR code can be printed, copied, and re-used with little friction. That makes it useful for mass phishing, physical-world fraud, and compromise of shared spaces where the code can be swapped or overlaid without immediate detection.
QR Code Phishing (Quishing) Guide is the best starting point for understanding the specific evasion patterns, including email, PDF, sticker, and payment-scam variants.
How organisations reduce exposure to quishing
Defence starts with treating QR codes as untrusted links, not as a safer alternative to ordinary URLs. Organisations should assume that any QR-bearing email, invoice, package insert, or poster can be weaponised, then apply the same scrutiny they would use for a suspicious hyperlink.
In practice, that means tightening email filtering, warning users before external redirects, validating payment and login paths out of band, and training staff to verify QR-driven requests through a known channel. For identity-heavy workflows, phishing-resistant authentication reduces the value of a stolen password, while fraud teams should watch for lookalike payment destinations and recently registered domains.
The credential angle is especially important when quishing is used against sign-in flows. Authenticator Apps and OTP Guide helps frame why QR-based enrolment and one-time password use need careful handling, because the attacker is often trying to reach the authentication step rather than the branded page itself.
Risk and Threat Considerations
Quishing creates a high-confidence lure with a low-effort delivery path, so it can bypass the skepticism that users sometimes apply to ordinary email links. The main risk is that the scan happens before the victim has any practical chance to inspect the destination, which makes credential theft and fraud more likely.
Failure mechanism: The attacker hides the malicious destination inside a scannable image, then relies on urgency, convenience, or routine behaviour to push the victim into a fake login, payment, or download flow.
Impact: The result can be account takeover, fraudulent payment activity, malware delivery, or follow-on compromise of adjacent systems that trust the stolen credentials or session.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1566 — Phishing | Quishing is a phishing delivery method that lures users via QR codes. |
| Recommendation — Map QR-based lures to T1566 and tune detections for image-based phishing delivery. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Quishing often targets user sign-in flows and credential theft. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Quishing investigations depend on reviewing sign-in, redirect, and fraud evidence. | |
| SI-3 — Malicious Code Protection | Quishing can deliver malware through a malicious destination or download. | |
| Recommendation — Strengthen user authentication so stolen passwords from quishing are less useful. Review authentication and web access logs for suspicious QR-driven login activity. Apply malicious code protection to catch payloads reached through QR-based redirects. | ||
| OWASP ASVS | V10 — OAuth and OIDC | Quishing commonly abuses login flows and identity prompts reached through redirects. |
| Recommendation — Protect OAuth and OIDC entry points against deceptive QR-driven authentication journeys. | ||
Practitioner Guidance
What to watch for: Treat QR codes in invoices, posters, delivery notices, and email attachments as an entry point that needs the same verification discipline as a link. The highest-value control is often user behaviour backed by clear process, not the code image itself.
Governance implication: Owners of payment, onboarding, and sign-in workflows should define how users verify QR-driven actions, how suspicious scans are reported, and how fraud or identity teams validate unexpected redirects. If a QR code is part of an operational workflow, it should be reviewed as an exposed trust boundary rather than a convenience feature.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 24, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org