Quishing Examples: 7 Real QR Code Phishing Attacks

Quishing is phishing with a QR code. Instead of a link you can hover over, the bad address sits inside a little black-and-white square. Scan it and, a second later, your phone's open on a fake payment page or a fake Microsoft login. You never really saw the address.

How does quishing work?

1. A code turns up in an email, a PDF, a letter, a parcel, or on a sticker in a car park.
2. There's a reason to scan it. Pay for parking. Reactivate MFA. Hear a voicemail. Find out who sent you a gift.
3. You scan with your phone, which usually has none of your work laptop's protections.
4. The page asks for something: card details, a Microsoft password, an app install.

Why the fuss about a QR code? Because email filters are built to read links. A QR code is a picture, so the link inside it often sails straight past them.

Real quishing examples

The car park problem

Across the UK, fraudsters stuck fake codes on council parking machines, sometimes over a genuine PayByPhone code and sometimes on machines that never had one. Drivers scanned, landed on a lookalike payment site and typed in their card. It wasn't one gang. Different, unconnected fraudsters picked up the same idea.

The fake MFA notice

In the office, the favourite story is security itself. In a 2023 case written up by AT&T Cybersecurity (now LevelBlue), staff got a PDF saying they had to set up Microsoft MFA, with a QR code to do it. Several scanned it and handed their passwords to a fake Microsoft page. The vendor said the incident was cleaned up with no confirmed data loss.

How to spot a quishing attempt

• A sticker on top of another sticker, or a code on a machine that didn't have one last week.
• An email or PDF asking you to scan a code to "set up", "verify" or "reactivate" your work login.
• A parcel nobody in the house ordered, plus a code that'll supposedly tell you who sent it.
• The address after scanning is nearly right. One letter off, or an odd ending like .info.

Tip: your phone shows the address before it opens it. Read it. For parking, honestly just use the app you already have.

How to stop quishing

• Pay through the operator's app or website, never a printed code on public kit.
• Only set up MFA through a process IT started, not from a code in an email.
• Use phishing-resistant MFA. Security keys and passkeys won't log in to a fake Microsoft page, whatever device you're on.
• Report suspicious codes to IT at work, and to the council or operator in public.

For side-by-sides, see quishing vs phishing and smishing vs quishing.

Quishing: common questions

Reviewed by the SEE Team on 23 October 2026; every case linked here has its sources on its own page.