SECURITY
QR Code Phishing (Quishing): What It Is, How It Works, and How to Protect Users
Malicious QR codes keep growing: APWG counted 716,306 in the third quarter of 2025 alone. Attackers deploy fraudulent codes in restaurants, hotels, parking lots, and public signage. This is the technical breakdown.
Updated October 2026 · 6 min read
KEY STATISTICS
716,306
Malicious QR codes Mimecast detected in Q3 2025 (APWG)
+13%
Growth over Q2 2025 (635,672)
5x
Kaspersky: blocked emails with malicious QR links, Aug to Nov 2025
3M+
Unique malicious QR codes, Q2 2024 to Q3 2025
George Smith — Founder, Klickify Agency
What Is QR Phishing (Quishing)?
Quishing is a cyberattack that uses malicious QR codes to redirect victims to fraudulent websites designed to steal credentials, install malware, or capture payment information. It exploits a fundamental property of QR code scanning: users cannot read the destination URL before scanning. In a traditional phishing email, a trained user can hover over a link to preview the destination. With a QR code, no preview is possible in the default scanning flow.
The numbers keep climbing. The APWG Phishing Activity Trends Report for Q3 2025 counts 716,306 unique malicious QR codes detected by Mimecast in that quarter, up 13 percent from 635,672 in Q2, and more than 3 million over the 12 months from Q2 2024 through Q3 2025. Kaspersky reported blocked phishing emails with malicious QR codes rising from 46,969 in August 2025 to 249,723 in November.
Four Quishing Attack Vectors
01
Physical overlay attacks
The attacker prints a fraudulent QR code sticker and places it over a legitimate code in a physical environment such as a restaurant menu, hotel check-in code, or parking payment terminal. The legitimate code underneath is obscured. Users scan the overlay and are redirected to a credential harvesting page that mimics the expected destination. Physical overlay attacks can persist for days before staff notice.
02
Malicious QR in email and documents
Email security filters detect malicious URLs in hyperlinks and HTML. Embedding a malicious URL in a QR code image bypasses most text-based link scanners because the URL is encoded in an image rather than present as text. Attackers use QR codes in phishing emails that claim to require scanning to verify identity or access a document.
03
Counterfeit codes on payment terminals
Payment terminals and parking kiosks increasingly support QR code payment. Attackers affix fraudulent QR codes over legitimate payment terminal codes, redirecting payment flows to fake collection pages. The victim believes they are paying for parking or a service while providing payment credentials to an attacker.
04
Compromised dynamic QR destinations
If an attacker gains access to a dynamic QR generator dashboard, they can change the destination URL of an existing QR code to a malicious site without touching the physical code. All printed instances immediately redirect to the attacker's destination. This vector is especially dangerous for organizations using shared credentials on QR generator platforms. The APWG report also notes that criminals use QR generators too, and that destination editing, scan tracking and free tiers can all be turned against defenders. That is why Safe-Scan checks a destination when a code is created and again when it is edited, and refuses an edit that fails the check.
High-Risk Environments
🍽️
Restaurants and cafes
Table QR codes for menus and ordering are prime overlay targets. High scan volume and unmonitored tables.
🏨
Hotels
Check-in QR codes, WiFi access codes, and restaurant ordering codes throughout the property.
🅿️
Parking facilities
Payment terminal QR codes at meters and kiosks with minimal supervision.
🏥
Healthcare facilities
Patient check-in codes and visitor WiFi access codes in high-trust environments.
🎪
Events and conferences
Registration QR codes and sponsor materials throughout large venues.
🚆
Public transit
Ticketing QR codes and payment terminals with high throughput and low inspection.
How Safe-Scan Works, and Where It Stops
Safe-Scan runs when you create or edit a dynamic code. It only accepts https destinations, rejects well-known URL shorteners (their final destination cannot be verified) and high-risk address patterns, and asks Google Safe Browsing whether the address is listed for malware or social engineering. A destination that fails is refused, and an edit that fails leaves the old destination in place. Every dynamic code also has a Safe-Scan page that shows the full destination URL, the domain, and the results of the checks.
Here is the limit, stated plainly: the redirect itself is immediate. A person who scans your printed code is sent to the destination without a preview step, and the check is not repeated on every scan. Safe-Scan will not catch a destination page that is compromised after you created the code, and it cannot stop someone from placing a different sticker over your printed code. For those cases the defenses are physical: tamper-evident displays, regular spot checks, and the expected domain printed next to the code.
What Businesses Can Do to Protect Users
1
Use tamper-evident QR code displays
Laminated or encased QR codes are more difficult to overlay than paper printouts. Custom-shaped or branded QR displays make unauthorized replacements visually obvious.
2
Inspect codes regularly in high-risk environments
Restaurant and hotel staff should periodically scan their own QR codes to verify they redirect to the expected destination. A 30-second spot check during setup identifies overlay attacks before guests encounter them.
3
Include the destination URL in text near the QR code
Print the expected destination domain next to the QR code. Users who see a different domain after scanning have a reference point for suspicion.
4
Monitor dynamic QR dashboards for anomalies
Dynamic QR dashboards show scan volume by time and location. An unusual spike in scans from an unexpected geographic area may indicate a fraudulent copy of your code has been deployed elsewhere.
5
Use a generator that checks destinations
Look for one that checks links when you create or edit a code and says plainly what it does not check. Safe-Scan does this on every dynamic code on Truly Free QR at no cost.
Generate QR codes with link checks built in
Safe-Scan checks every dynamic code when you create or edit it. No premium plan. No account needed.
Create Safe QR Code