What is quishing (QR code phishing) and how do I spot it?

Quishing is the QR-code version of a phishing scam. Instead of a text link you can hover over and check, the email contains an image of a QR code, often disguised as an MFA re-registration request, a delivery notice, a payslip, or an invoice. Scanning it with your phone takes you to a fake login page designed to steal your Microsoft 365 password, or triggers a malware download.

Why it's harder to catch

• No visible URL. You can't preview where a QR code goes the way you can hover over a link.
• It's usually scanned on a phone, often outside the security software protecting your office computers.
• It's frequently hidden inside a PDF attachment rather than the email body, specifically to dodge filters that only scan message text. By March 2026, Microsoft found around 70% of quishing emails used this trick.

Microsoft's own telemetry recorded a 146% increase in QR code phishing over Q1 2026, so this isn't a fringe tactic; it's currently one of the fastest-growing scam formats.

How to spot and stop it

• Treat an unexpected QR code in an email exactly like an unexpected link, don't scan it.
• If it claims to be from Microsoft, your bank, or a supplier, go to the site directly yourself rather than scanning.
• Confirm your email protection actually scans QR codes and attachment content, not just standard links, Microsoft Defender for Office 365 supports this, but it needs to be properly configured.
• Report anything suspicious to whoever manages your IT, even if nobody clicked through.

See our full guide on quishing and how Perth businesses can protect against it, or call (08) 9325 1196 if you'd like us to check your email security is catching this.