SecurityRingBook a Demo

Glossary

What is quishing? QR code phishing explained

Phishing that uses a QR code to hide the malicious link, so the victim scans it with a phone and opens a fake page away from desktop protections.

Quishing (QR + phishing) is a phishing attack that uses a QR code instead of, or as well as, a visible link. The person scans the code with a phone camera and is taken to a site that asks for credentials, payment details or a malicious download.

The FBI’s Internet Crime Complaint Center has warned that criminals tamper with digital and physical QR codes to redirect victims to malicious sites. The FTC describes QR codes sent by unexpected email or text that invent a reason to scan, such as a missed delivery or an account problem.

On SecurityRing, QR phishing is a live email simulation: one code per recipient, other links disabled so scanning is the measured action, scans counted separately from clicks, then a short lesson. Printed or physical QR codes are not part of the product. See QR code phishing simulation.

Sources

Every clause, incident and figure above comes from these official or original sources.

  1. FBI IC3Cybercriminals Tampering with QR Codes to Steal Victim FundsPublished 18 January 2022 · Accessed 16 October 2026.
  2. Federal Trade CommissionScammers hide harmful links in QR codes to steal your informationPublished 6 December 2023 · Accessed 16 October 2026.