Quishing vs phishing is about where the link hides. In ordinary phishing it’s a link you can see and click. In quishing it’s packed inside a QR code, so you have to scan it with your phone to find out where it goes.
That small change does two things. It moves the click from a protected work computer to a personal phone. And because a QR code can be printed, it lets scammers reach people who never got a message at all.
| Phishing | Quishing | |
|---|---|---|
| Where the link is | Visible text or a button in an email | Inside a QR code image |
| Where you open it | Usually on the device that got the email | On your phone, after scanning |
| Can filters read it? | Yes, links can be scanned, rewritten or blocked | Harder, because the link is part of a picture |
| Needs a message? | Yes | No. A sticker on a parking meter works too |
| A case from this library | Target (2013): an email to a contractor led to about 40 million card accounts exposed | Orlando (2025): about 200 fake QR stickers found on parking meters |
| What stops it | Filters, link checks, phishing-resistant MFA | Read the link preview, and pay through the official app |
Key takeaways
When a phishing link arrives at work, a lot happens before you see it. The email gateway may scan it, rewrite it or block it outright. You can hover over it and read the real address. If you click, it opens on a laptop the company manages.
A QR code dodges most of that. It’s an image, so text-based link scanning doesn’t see a URL to check. You point your phone at it, and now the fake login page is open on a device that probably has none of your employer’s protections. The small screen makes a dodgy address easier to miss as well.
Between September and October 2021, Abnormal Security blocked nearly 200 emails dressed up as missed-voicemail alerts, each with a QR code that led to a fake Microsoft login page. The emails came from real, compromised Office 365 accounts, so they often passed standard sender checks. Full case: missed-voicemail QR campaign.
In a 2023 case documented by AT&T Cybersecurity, now LevelBlue, employees at a client company received a PDF that looked like a Microsoft MFA setup notice. Several scanned the code and typed their credentials into a fake Microsoft page. The vendor reported the incident fully remediated, with no confirmed data loss. Full case: fake MFA setup QR code.
Across the UK, fraudsters stuck fake QR stickers on council parking machines and signs, sometimes over genuine PayByPhone codes and sometimes on machines that never had a code at all. Scans led to cloned payment sites. Of the 373 councils that answered freedom of information requests from the Bureau of Investigative Journalism, 123 said they’d had reports of it. Full case: UK council car park QR scams.
In June 2025, downtown Orlando’s parking enforcement recovered roughly 200 counterfeit stickers placed over ParkMobile decals on meters. Police warned the codes led to a site built to steal personal information, though no victim or loss was ever confirmed. Full case: Orlando parking meter QR scam.
Tip: before you open a scanned link, look at the address your phone shows you. If you’re paying for parking, close it and use the operator’s app instead. A sticker is easy to fake. The app on your phone isn’t.
Browse the quishing case collection or the wider phishing cases.
Yes. It’s phishing where the link is delivered as a QR code. The aim is the same, usually a password or card number. The texting version is smishing; see smishing vs quishing.
Because a QR code is an image, it’s harder for email security to read and check the link inside it. Scanning it also moves the victim to their phone, which is often outside company protections.
Scanning on its own just reads a link. The damage comes from what you do next: entering a password, paying, or installing something. Check the address before you open it, and don’t type credentials into a page you reached by scanning.
They can. In 2025 the FBI, FTC and US Postal Inspection Service each warned about unsolicited packages with a QR code inviting the recipient to find out who sent the gift. See the brushing package QR scam.
Tell the parking operator or the council that runs the car park, and avoid paying through that code. If you’ve already paid, call your bank on the number on your card and report it to the police or your national fraud reporting service.
Reviewed by SEE Team. Last reviewed 21 Oct 2026. Each case link goes to the full write-up, sources included. How pages are researched and fact-checked. About Social Engineering Examples.
Social Engineering Examples