Quishing is phishing through a QR code. The fake link is not clickable text in the email but is hidden in a QR code in the email, an attachment or on paper. Whoever scans it lands on a fake sign-in or payment page.

Is a QR code in an email always suspicious?

Not always, but it is if you have to use it to sign in, change a password, set up two-step verification or pay. In those cases always open the app or the known website yourself.

Does the spam filter stop QR code phishing?

Not always. A QR code is an image and not every filter reads the link from it. That is why these messages reach the inbox more often than ordinary phishing. The agreement within your team remains the most important defence.

What does Floor ICT do when an employee has scanned a fake QR code?

Floor ICT revokes the sessions, checks two-step verification, removes suspicious inbox and forwarding rules and works out from the logs what happened. Any report to the bank or the Dutch Data Protection Authority is up to you.

QR code phishing: how an SME should spot fake QR codes in email and on paper

An email from ‘IT’ or ‘Microsoft’ says two-step verification is about to expire. Scan the QR code to renew it. There is no link in the email, just an image. A colleague picks up their phone, scans, and signs in on a page that looks exactly like Microsoft 365. The password and the code are already gone.

How a fake QR code gets in

QR code phishing works like ordinary phishing: someone tries to send you to a fake sign-in page or get you to pay something. The difference is that the link sits inside a QR code. In an SME it usually arrives in one of these ways:

in an email: a message that appears to come from Microsoft, the IT department or HR asks you to scan a QR code, for example to ‘renew’ two-step verification, open a shared document or view a new payslip;
in an attachment: the QR code sits in a PDF or image, so there is no link visible in the email itself;
on paper or in the street: a letter that looks like a payment reminder, a sticker over the real QR code on a parking meter or charging point, or a flyer saying ‘scan for your discount’.

The email version matters most for a business, because it goes straight for an employee’s Microsoft 365 account.

Why it slips past security

Two things make QR code phishing tricky:

the filter sees no link: email security mainly checks clickable links. A QR code is an image, and not every filter reads it. The message therefore lands in the inbox more often;
the scan happens on a phone: the employee reads the email on their laptop but scans with their phone. That is often a personal phone without the protection of the workplace, and on a small screen nobody sees properly which address actually opens.

That is why the agreement within your team is the most important defence here too, just as with invoice fraud.

The agreement you make

Keep the agreement short, so everyone remembers it:

never sign in through a QR code: a genuine request to sign in, change a password or set up two-step verification does not reach you through a QR code in an email. Anyone who gets such a request opens the app or the known bookmark themselves;
never pay through a QR code from an email or letter: always check a payment request through a channel you already had, such as the customer portal or a phone number from your own records;
report doubts straight away: agree one place where colleagues forward or report a suspicious email, and make clear that reporting never earns blame, not even after a scan;
QR codes outside: if there is a sticker over a QR code on a machine or charging point, use the provider’s app instead.

What you set up technically

Technology does not prevent every scan, but it does prevent much of the damage afterwards:

strong two-step verification: with two-step verification and number matching, a stolen password alone is not enough. Passkeys are stronger still, because they only work on the real Microsoft site;
conditional access: only allow sign-ins from managed devices or trusted situations, so an attacker with a stolen session gets less far;
email security that checks images: make sure email security covers links in images and attachments as well as it can, and turn on safe links and attachments;
alerts on unusual sign-ins: make risky sign-ins stand out, so a sign-in from a strange country or device is noticed quickly.

Scanned and signed in: what now

If someone has scanned a fake QR code and then entered their details, every minute counts:

change the password of that account straight away, from a trusted device;
have all active sessions revoked, so an attacker with a stolen session is signed out too;
check whether new two-step verification methods, forwarding rules or inbox rules have been added;
see whether email has been sent from the account to customers or colleagues, and warn them if needed;
if payment details were entered, call your bank straight away.

Then assess whether personal data may have been viewed. If so, a report to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) may be needed. You make that assessment yourself; Floor ICT supplies the facts from the logs.

What Floor ICT handles

Floor ICT sets up two-step verification, conditional access and email security in Microsoft 365, and keeps an eye on sign-ins. When an account is suspected to be stolen, we revoke sessions, remove suspicious rules and methods and work out from the logs what happened. You agree the rules on QR codes and reporting with your team yourself; we are happy to help with the wording.