QR code phishing, known as quishing, slips past email filters because the malicious link is embedded inside an image rather than written out as text. Filters built to scan message text and hyperlinks for known-bad URLs do not automatically decode a QR code graphic, so the link inside it is never extracted or checked. The message passes scanning with nothing visibly malicious in the body, and the user supplies the destination themselves by scanning the code, often with a phone camera outside your monitored network.
How your email filters actually work
Standard email security tools are built around sender and header details, the text of the message, and any hyperlinks or attachments that can be extracted and checked against reputation lists. A QR code is just a picture. Unless a filter includes a specific step to decode QR graphics and pull out the embedded URL, that step does not happen on its own. The image is treated the same way as any other photo in the message.
Why this gap matters for your business
The email passing a scan is not the main problem. What happens next, where the scan takes place, is. If an employee scans the code with a personal phone, the resulting browser session runs outside your corporate network, outside endpoint protection, and outside any conditional access policy tied to a managed device. A credential-harvesting page that would normally trigger a block on a company laptop can load unchecked on a personal phone's default browser.
Where quishing shows up
A quishing message typically mimics something a person expects to act on quickly, with the link swapped for a code. Illustrative lure patterns include:
- A fake multi-factor authentication or account re-enrollment notice asking the recipient to "scan to verify."
- A PDF attachment styled as an invoice, delivery notice, or parking notice, with a QR code in place of a clickable link.
- A vendor or payroll message asking the recipient to scan a code to view a statement or update banking details.
What to check this week
- Confirm your filter's QR capability. Ask your email security vendor or internal IT lead whether the gateway decodes QR codes in images and attachments and checks the extracted URL against reputation data. Verify by sending a test message with a QR code pointing to a known benign test link and seeing whether it gets flagged or rewritten.
- Set a device policy for work-related codes. Require that any QR code tied to MFA, payroll, or finance actions be scanned from a managed device and browser, not a personal phone. The IT lead owns this policy. Verify by spot-checking that the guidance appears in onboarding and security awareness materials.
- Update phishing training specifically for quishing. If your awareness training focuses on hovering over links and checking the URL, a QR code gives the user nothing to inspect, so the lesson needs its own example. The security awareness owner verifies this by including a QR-based scenario in the next simulation.
- Add secondary verification for high-risk requests. For payroll changes, wire instructions, or credential resets triggered by a scanned code, require a second channel of confirmation regardless of how legitimate the code's target page looks. Finance and HR leads own this step.
Trade-off: training versus tooling, and when to act
If budget is tight, policy and training changes are cheaper and faster to put in place than replacing an email security stack, and they address the human decision point directly. Training alone has a known failure mode here: it relies on the user recognizing a suspicious link, and a QR code gives them nothing to inspect before they scan. If your current filter cannot decode QR images at all, that is the point to act on tooling, not just policy. If your filter already handles this, treat the checklist above as the finishing layer rather than a reason to wait.
How to test the fix
Do not assume the gap is closed because you updated a slide deck. Run a controlled phishing simulation that includes a QR-coded message and a benign landing page, and track two things: whether the gateway flags or rewrites the code, and whether users who scan it land on a page you control rather than report it unprompted. This kind of simulation, paired with a review of what your current gateway actually decodes, is the sort of gap analysis our managed security and virtual CISO work is built around: closing a specific, verifiable gap rather than adding another tool for its own sake.
If you are not sure where your email filter stands on image-based threats like this, a free security review is a low-friction way to find out before it becomes an incident response conversation instead.
