Email security filters scan text, links, and attachments. They don't scan QR codes — which are just images. Attackers know this. Quishing (QR code phishing) embeds malicious URLs in QR codes delivered via email, bypassing most email security tooling entirely.
In 2023, Microsoft's Security Intelligence team reported a significant increase in QR code phishing campaigns, with some individual campaigns targeting over 1,000 organisations. The campaigns typically impersonated Microsoft, bank login pages, or parcel delivery notifications — familiar contexts that prompt immediate action without much scrutiny.
Why QR Codes Bypass Email Security
Email security filters work by analysing text content, link URLs, and attachment types. A phishing email containing a text link to a malicious site will typically be caught — the URL is analysed against threat intelligence feeds and the link is either blocked or flagged. A QR code is a PNG image. The malicious URL is encoded in the image's visual pattern, not in the email's text or link fields. Most email security tools cannot decode QR code images and have no visibility into the URL they encode.
Additionally, when someone scans a QR code with their phone, they're redirected to a mobile browser — which is likely a personal device without corporate security controls, DNS filtering, or Safe Links protection. The attack lands on the most unprotected device in the chain.
Common Quishing Scenarios
Microsoft MFA reset: An email claiming to be from Microsoft IT security states that the recipient's MFA configuration needs to be verified. Scanning the QR code takes them to a convincing Microsoft login page that captures their credentials and MFA token in real time.
Parcel delivery: A supposed NZ Post notification asks the recipient to scan a QR code to confirm their delivery address. The landing page requests credit card information for a "customs fee."
Benefits and HR: Emails appearing to come from internal HR or payroll asking staff to update their banking details by scanning a QR code — a variant of the payment redirection attack targeting personal salary payments.
What Defends Against Quishing
Technical controls: Some advanced email security platforms now include QR code image scanning — extracting and analysing the encoded URL as part of the email inspection process. Microsoft Defender for Office 365 Plan 2 includes this capability. For organisations on lower-tier email security, supplementary QR code scanning tools can be added.
Behavioural control: Staff should be trained to treat QR codes in emails with the same suspicion they'd apply to text links — ask where it's going before scanning. A legitimate Microsoft communication will never require a QR code scan for account verification. A legitimate NZ Post delivery notification has your delivery details already.
Quishing works because QR codes look like a legitimate modern convenience while being invisible to most security tooling. Treat every unexpected QR code in an email as a suspicious link — because that's exactly what it is.
