What is quishing?
Quishing is phishing delivered through a QR code. The name combines QR and phishing. Nobody can read a QR code by looking at it, so the victim cannot see where it leads until after scanning it, and the scan usually happens on a personal phone. That moves the victim off the managed laptop, away from the mail gateway's link checks, the web proxy and endpoint protection, and onto a small screen that shows only part of the web address.
Where quishing shows up
Quishing appears in both email and the physical world:
- Email: a message claiming the recipient's MFA enrollment expires today and asking them to scan a code to re-register, or a document-signing notice with a QR code in place of a link. Older mail filters checked text links and missed links inside images.
- Payments: stickers placed over the real codes on parking pay stations and EV chargers, sending drivers to a fake payment page. Cities in the United States and the United Kingdom have reported them.
- Paper: fake parking tickets, delivery cards, posters and flyers offering a discount or a prize.
A quishing example
Several employees receive an email that looks like an HR notice about updated benefits. The body contains no clickable link, only a QR code and the instruction to scan it with a phone to review the changes. The mail filter found no URL to check, so the message reached inboxes. The phone's camera preview shows a domain unrelated to the company, and the page that opens is a copy of the company sign-in page. The detail that makes it quishing is that the QR code carried the link past the filter.
How to defend against quishing
- Use mail security that decodes QR codes in images and attachments and checks the embedded URL like any other link.
- Set a rule that IT and HR never send QR codes for sign-in or account changes, and tell staff about it.
- Train users to read the address the camera app previews before opening it, and to treat a QR code that leads to a sign-in or payment page as suspicious.
- Protect company phones with mobile device management, a mobile threat defense app or DNS filtering.
- For payments, type the operator's known web address or use its official app instead of scanning a public code, and have facilities staff inspect public-facing codes for stickers placed over the originals.
- Use phishing-resistant MFA so captured passwords are less useful.
Quishing vs. phishing vs. skimming
A QR code inside an email is quishing rather than plain phishing, because the code is what carries the link past the filters. Skimming copies card data with a tampered physical card reader. A driver who scanned a sticker and typed a card number into a fake website was quished, not skimmed, because the card never touched a tampered reader.
Quishing on the CompTIA Security+ exam
Quishing sits under SY0-801 objective 2.5 with phishing, smishing and vishing. The deciding clue is a QR code: in an email, on a poster, on a sticker over a payment terminal or on a letter. Distractors include phishing, smishing, skimming and watering hole attacks. For defense questions, look for QR-aware email scanning, user training to check the previewed address, and typing known addresses instead of scanning. The term also appears in A+ Core 2 (220-1202) objective 2.5.