A QR code is a link you cannot read.
That single sentence explains most of what follows. Every security habit built over twenty years of email defense assumes a human or a machine can look at a destination before committing to it. Hover over the link. Check the domain. Let the filter rewrite the URL and detonate it in a sandbox. A QR code removes all of that. It is a picture of an address, and the only way to find out where it goes is to go there.
Attackers noticed. The technique has a name now, quishing, and it has moved from a curiosity to a standard part of the phishing toolkit.
What the data actually shows, including the part most articles leave out
Microsoft Threat Intelligence tracked a sharp escalation through the first quarter of 2026: QR code phishing attacks rose 146 % across the quarter, from 7.6 million detections in January to 18.7 million in March, the highest monthly volume in at least a year.
Here is the part you will not see in most write-ups. Microsoft’s follow-up report, published on July 23, 2026, shows the wave receding just as fast. April fell 7 % to 17.4 million, May fell 38 % to 10.8 million, and June fell another 22 % to 8.3 million, returning to levels last seen in mid-2025.
We include both figures deliberately, because the honest reading is more useful than the alarming one. QR phishing is not a straight line upward. It is a technique attackers surge and retire as defenses adapt, exactly like macro-enabled documents and HTML attachments before it. Volume moves. The underlying weakness does not, which is why it will surge again.
Two structural findings from the same period are more durable than the volume:
- QR codes now arrive inside attachments. Between January and March 2026, the share of QR attacks delivered via PDF attachment rose from 65 to 70 %. Barracuda’s 2026 Email Threats Report found that 70 % of malicious PDF attachments contained a QR code leading to a phishing site, and 56 % of malicious Microsoft 365 documents did the same.
- The brands being imitated are the ones your team trusts. Cisco Talos analysis found Microsoft and DocuSign were the most impersonated brands in phishing emails carrying PDF attachments. Barracuda observed QR codes embedded in invoices, signature requests and policy update notices spoofing Microsoft, DocuSign and SharePoint.
Unit 42, the threat research team at Palo Alto Networks, reported in February 2026 that it detects over 11,000 malicious QR codes per day, and that of roughly 75,000 QR codes observed daily in its crawler telemetry, about 15 % resolve to malicious destinations.
Why email security misses it
Six reasons, each documented.
- The payload is an image. Text-based scanning engines were built to parse and evaluate URLs. A QR code is pixels. Microsoft’s own analysis notes that attackers embed malicious URLs within image-based formats precisely because text scanning struggles with them.
- It defeats URL rewriting and sandboxing. In a joint advisory published on January 8, 2026, the FBI and CISA described North Korean Kimsuky actors running QR code spearphishing campaigns against think tanks, academia, NGOs and US government entities, and stated plainly that the technique succeeds by “evading URL inspection, rewriting, and sandboxing.” When your email security product cannot see a link, it cannot rewrite it, and the protection you are paying for never engages.
- The attack jumps to a device you do not control. This is the most important one for a business. Scanning moves the victim from a managed laptop, behind your filtering and your endpoint protection, onto a personal phone that has none of it. Cisco Talos put it directly: QR code attacks move the attack vector off a protected computer and onto the target’s personal mobile device, which usually has fewer security protections. On a phone, the user also cannot hover to preview a destination, and the address bar truncates the domain, so the one manual check that might have caught it is not available.
- The redirect infrastructure is legitimate. Attackers route through commercial QR shortener services. Unit 42 documented systematic abuse of qrco.de, me-qr.com and qrs.ly, with QR shortener traffic growing 44 % between the first half of 2024 and the first half of 2025. Mimecast data published through the Anti-Phishing Working Group documented a shift toward scan.page, view.page, qrfy.io and TinyURL. Because these endpoints are dynamic, an operator can re-point the destination after the code has been delivered or reviewed.
- The code can be built to defeat detection. Once vendors deployed optical character recognition to read QR images, attackers adapted. Check Point documented QR codes constructed from HTML and ASCII block characters rather than images, in over 600 emails observed in late May 2024. To a person it looks like a QR code. To OCR it looks like nothing. Barracuda has since observed QR codes split across multiple images and malicious codes nested inside legitimate ones. Cisco Talos documented PDFs where the visible QR code points to a legitimate site while hidden annotations carry the actual phishing destination.
- The landing page stalls automated analysis. Microsoft found QR campaigns in the first quarter of 2026 frequently gated behind a fake CAPTCHA screen before the credential harvesting page, a technique that blocks automated crawlers while looking like a routine security check to a human.
The three places your business will meet it
In an invoice or a signature request
This is the version that costs money. A PDF arrives that looks like an invoice, a remittance advice, a DocuSign envelope or a Microsoft security notification. The QR code is presented as the way to view the document or complete a payment. The destination is a credential harvesting page styled as a Microsoft 365 login.
Sophos published a detailed account of experiencing exactly this internally. Across waves in February, May and June 2024, employees received PDF attachments impersonating internal office scanner notifications, with subject lines like “2024 financial plans,” “benefits open enrollment,” “dividend payout” and “contract agreement.” In the June incident, one employee was compromised. The attacker captured the username, the password, and the multifactor authentication token, via an adversary-in-the-middle proxy. Other internal controls prevented access to internal assets.
That case is worth sitting with. Multifactor authentication was in place, and it was defeated, because the method used was not phishing-resistant.
On a physical surface
The parking meter version is the one that has reached the news, because it is cheap, physical and effective. A fraudster prints a sticker and places it over the legitimate payment code. The victim scans, lands on a convincing payment page, and enters card details.
Documented cases include Orlando in June 2025, New York City in June 2025 where the Department of Transportation launched citywide inspections of ParkNYC meters, Asheville, North Carolina in February 2026, and Toronto in April 2026. The Federal Trade Commission’s consumer alert of December 6, 2023 named the technique explicitly, noting that scammers cover legitimate QR codes on parking meters with fraudulent ones.
The clearest loss data comes from the United Kingdom, where reporting is centralized. An investigation by The Bureau of Investigative Journalism, published June 27, 2025, found that Action Fraud recorded nearly 800 QR fraud reports in the twelve months to April 2025, with victims losing a total of £3.5 million. Freedom of information responses identified around 400 affected car parks, with Sheffield reporting that all 370 of its parking ticket machines had been targeted.
For a business, the physical version matters in two ways. It is how your employees get conditioned to scan codes without thinking. And if your business displays a QR code to customers, on a table tent, a poster, an invoice or a delivery slip, that surface is now something you need to check.
On an unexpected package
The FBI issued a public service announcement on July 31, 2025 covering unsolicited packages containing QR codes used to initiate fraud schemes. Scanning either prompts for personal and financial data or delivers malware to the phone. The Federal Trade Commission published a matching alert in January 2025 describing packages arriving with no sender and a note inviting the recipient to scan a code “to identify the sender.”
What actually stops it
The FBI and CISA published a mitigation list in the January 2026 advisory. It is short, and it is the right list.
Require phishing-resistant multifactor authentication. This is the highest-value control on the page. Standard MFA using push notifications or one-time codes can be relayed in real time by an adversary-in-the-middle proxy, as the Sophos case demonstrates. Device-bound passkeys and FIDO2 hardware security keys cannot, because the credential is cryptographically bound to the legitimate domain. If you do one thing after reading this article, start the passkey rollout for your finance team and your administrators.
Deploy mobile device management. The attack succeeds by moving to an unmanaged phone. Managing the phones that touch business email closes the gap that the technique is built to exploit.
Choose email security that decodes QR images. Not all products do. Ask your provider directly whether their engine extracts the URL from a QR image inside an attachment, rewrites it, and evaluates the destination. If the answer is vague, that is your answer.
Verify payment changes out of band. The FBI’s standing guidance on business email compromise is to use a secondary channel to verify any request to change account or payment information. Applied here: no bank detail changes and no payment releases on the strength of a scanned code, ever. Confirm on a phone number you already had on file, taken from your vendor records rather than from the message.
Retrain what your team is looking for. The old advice was to inspect the link before clicking. With a QR code there is nothing to inspect until after the scan, so the check has to move earlier. The practical rules: do not scan a code that arrived unexpectedly, especially inside an attachment; if you do scan, read the full domain on the preview screen before you tap through; and treat any code that leads to a login page as suspect by default, because a legitimate document rarely asks you to sign in again on a phone.
Add the physical check. Tell staff to look for a sticker layered over a printed code, and to report it rather than peel it off silently. New York City’s guidance to the public was blunt: if you see a QR code sticker on a parking meter, do not scan it.
Monitor credential entry and keep least privilege in place. Both are on the FBI and CISA list, and both limit what a successful scan can turn into.
The short version
QR code phishing is not a new category of attack. It is the same credential theft and payment fraud your business already faces, wrapped in a format your email filter cannot read and delivered to a device you do not manage. Volume will keep moving up and down as defenses adapt. The weakness it exploits, that a picture of a link is invisible to inspection, does not go away.
The controls that hold are the ones that do not depend on anyone correctly evaluating a message: authentication that cannot be relayed, devices you manage, and a payment process that verifies on a separate channel every single time.
Getting help with it
Alchanis Technical Services is a veteran-owned managed security provider. We help small and mid-size businesses across the United States close the gaps that email filtering alone does not cover, from phishing-resistant authentication to mobile device management to the payment verification rules that keep a scanned code from becoming a wire transfer.
If you want a clear picture of where your business is exposed, we are at alchanistech.com.
