QR code phishing (quishing) simulation
QR code phishing simulation, in a realistic email
Quishing hides the link inside a QR code, so the victim opens the fake page on their phone. SecurityRing lets your employees meet that trick in a phishing email, records who scanned the code, and teaches them on the spot.
Simulated phishing emailIT Service Desk · Action required
Re-register your authenticator before Friday
Your sign-in method expires this week. Use your phone to re-register.
Open the portal (link disabled in the simulation)
Scan this code to continue
The real attack
A code you can’t read, on a phone you don’t check
The FBI’s Internet Crime Complaint Center has warned that criminals tamper with digital and physical QR codes to send victims to malicious sites that ask for login and financial information. Among its tips: check the web address after you scan, and call the company if an email says a payment can only be completed through a QR code. The FTC describes QR codes sent by email or text with made-up reasons to scan, such as a missed delivery, an account problem or “suspicious activity” that needs a password change.
Because the link is inside an image, people cannot hover over it before they act, and the page opens on a personal device.
How the simulation works
One code per person, no clickable bypass
A phishing email
Build the email in the AI Builder or from a recommendation, with QR phishing as the attack type. At send time, SecurityRing places one QR code for that recipient under the words “Scan this code to continue”.
Other links are turned off
SecurityRing turns the email’s ordinary links and buttons into plain text, so the recipient cannot open the lure by clicking. The code is the measured action.
Scan, then learn
Scanning opens the simulated page on the phone. SecurityRing records the scan (and filters out automated scanners), then shows the training page: a short video of that email with its red flags highlighted, and a quiz.
What you see
QR scans, counted on their own
- QR scans as a separate figure in the campaign report, alongside opens and clicks
- Per-person rows that show “Scanned QR code”
- Risk by department, location, seniority and manager, plus focused retests
- Download PPT, Download PDF or CSV
SecurityRing’s QR simulations are delivered by email. Printed posters, parking meters and other physical QR codes are not part of the product.
Launch in minutes
Four steps per campaign
Choose people
Everyone, chosen departments or named people from your roster.
Pick a recommended attack
Choose an idea recommended for your industry, tools and news, then click “Build this idea”.
Approve what AI built
The AI Builder drafts the email, landing page, lesson and quiz. Edit anything, then approve.
Schedule and launch
Optionally send yourself a test, set the delivery window and pace, and activate.
One-time setup: import your roster and have your email admin allowlist SecurityRing’s sender details (a ready-made request is in the app).
What is quishing?
Quishing is phishing through a QR code. The code hides a link, so the person scans it with a phone and opens a fake page there, often away from the protections on their work computer. The FBI and the FTC have both warned that criminals use QR codes to send people to sites that steal login and financial information.
How does SecurityRing simulate QR code phishing?
In an email simulation. SecurityRing places one QR code per recipient in the email, under the words “Scan this code to continue”, and turns the email’s other links and buttons into plain text, so scanning is the only way forward. Scanning opens the simulated page on the phone, SecurityRing records the scan, and the employee sees a short lesson.
Does a security scanner or an image preview count as a scan?
No. Loading the QR image does not record anything, and SecurityRing filters out automated scanner traffic before it records a scan. Only following the link inside the code counts.
Are QR scans reported separately from clicks?
Yes. The campaign report shows QR scans as their own figure, and each person’s row shows “Scanned QR code”, so you can see who scanned and focus retests on them.
Can we simulate printed QR codes on posters or parking meters?
No. SecurityRing’s QR simulations are delivered by email. Printed or physical QR codes are not part of the product.
Which other channels can SecurityRing simulate?
Email phishing, including QR-code and ClickFix attacks, and deepfake video of your consenting leaders inside email are live. WhatsApp is in private beta. LinkedIn, voice-call (vishing) and SMS (smishing) simulations are coming soon and are not available yet.
Sources and method
- FBI Internet Crime Complaint Center, “Cybercriminals Tampering with QR Codes to Steal Victim Funds”, 18 January 2022. Accessed 16 October 2026.
- Federal Trade Commission, “Scammers hide harmful links in QR codes to steal your information”, 6 December 2023. Accessed 16 October 2026.
The product flow above is described from SecurityRing’s email renderer and tracking routes as of 16 October 2026.
Run a QR phishing simulation before attackers do
See the email with the code, the report and the lesson in a demo.