What is quishing? Quishing is phishing through a QR code: the scam link is hidden inside the code, so the person scanning it cannot see where it leads until their phone opens it. The FBI describes quishing as embedding malicious links in QR codes "to force victims to pivot from their corporate endpoint to a mobile device, bypassing traditional email security controls."

That definition comes from an FBI FLASH alert issued in January 2026. It extends everything in how phishing actually works and how to spot it to a format people cannot read with their own eyes, and it shows up in places most security training never mentions: invoices, parking meters, posters, and PDFs.

A street parking meter at night with a square sticker pasted over its panel, lit by hot pink light against black, for an article on what is quishing — A sticker over a real code is the oldest quishing trick. The FBI warned about it in 2022.

What is quishing, and why do scammers use QR codes?

A QR code solves the scammer's biggest problem with an emailed link: the link is visible. A person can hover over it, read the domain, and notice that something is off. A code is a pattern of squares that tells a human nothing.

The second advantage is the device switch. The FBI's wording is precise: the code pushes the victim from a managed work computer to a phone, where the company's email security controls no longer see it. The scan happens on the device with the smallest screen and, often, the least oversight.

I study behavioral psychology, and QR codes carry a learned trust. Restaurants, ticketing, and payment apps taught everyone that scanning is normal and safe. Quishing borrows that habit and points it somewhere else.

Where do quishing codes show up for a business?

In email and attachments first. The FBI's January 2026 alert concerned a North Korean group sending QR codes to think tanks, academic institutions, and government organizations, with the codes leading to fake login pages.

The FTC's December 2023 alert gives the plain rule for email: "Don't scan a QR code in an email or text message you weren't expecting." That applies to a code on a PDF that claims to be a payroll update, a shared document, or a voicemail notice.

A torn poster on a bare concrete wall with a square black and white sticker layered over one corner, lit hot pink, showing how quishing codes cover real ones — A printed code in a public place is only as trustworthy as whoever last had access to the wall.

Physical codes are the second route. The FBI's January 2022 PSA, "Cybercriminals Tampering with QR Codes to Steal Victim Funds," described criminals placing their own codes over legitimate ones. The FTC returned to the theme in September 2026 with a warning about QR codes on parking meters. For a business, that means the lobby sign, the conference badge, the delivery slip, and the code on a vendor's truck.

Invoices are the third, and the one that touches finance. A code that promises a fast way to pay can lead to a payment page the vendor never set up. That is the same goal as business email compromise, delivered in a format your accounts payable team may not think to question.

How common is quishing?

No reliable public count exists. I have not found a government figure or independent research measuring quishing on its own, and the numbers that circulate tend to come from security vendors describing their own customers. Rather than borrow one of those, this article leaves the number out.

What the FBI does publish is the size of the wider category. The IC3 2025 Internet Crime Report recorded 191,561 phishing and spoofing complaints in 2025, more than any other crime type. The FBI defines that category as unsolicited email, text messages, and phone calls asking for personal, financial, or login details, so QR codes sent by email or text fit within it, though the report does not count them separately.

The useful question for an operator is a different one: where do QR codes enter your business processes, and can any of them move money or credentials? That inventory is usually short, and it is where the controls belong.

A blank invoice sheet clipped to a metal clipboard on a black desk, edge-lit hot pink, the vendor bill where quishing reaches accounts payable — Pay invoices through the channel and bank details you have already verified, never through a code printed on the bill.

How do you check a QR code before you trust it?

The FBI's 2022 PSA lists the core habits. Check the web address after scanning and before opening it. Look for stickers or signs of tampering on physical codes. Do not download apps from a QR code, do not use a third-party scanner app, and type payment addresses in manually rather than scanning them.

The FTC adds a judgment call: "If you see a QR code in an unexpected place, inspect the URL before you open it." Read the domain letter by letter, the way you would for an emailed link, and close the page if it asks you to sign in or pay.

For anything that leads to a login, the safest habit is to skip the code. Open the app or type the company's address yourself. The code saves a few seconds, and those seconds are exactly what the scammer is counting on.

A hand holding a smartphone up toward a dark wall, the phone screen a soft unreadable glow, lit by hot pink light with shallow depth of field, the moment of a quishing scan — The pause between scanning and opening is the one place a person can still catch a bad code.

How do you stop one bad scan from becoming a breach?

Assume someone will eventually scan the wrong code, and design so that it does not matter much. The strongest control is phishing-resistant MFA. CISA calls it "the gold standard" and names FIDO/WebAuthn as the only widely available form. NIST defines phishing resistance as protection that works "without reliance on the vigilance of the claimant," which is the right standard when the threat is a code nobody can read.

Push approvals are weaker, for the reasons covered in what is MFA fatigue.

On the finance side, write one rule into the payables process: invoices are never paid by scanning a code. Payments go through the portal or bank details on file, verified by phone when anything changes. Email security beyond "don't click the link" covers the wider set of controls that keep a single message from deciding an outcome, and what is smishing covers the text-message route many QR scams arrive by.

Not sure? Check before you act

When a code, message, or page asks you to sign in or pay, run through these steps. The full method is in how to check if a message is a scam.

Stop before you open the link the code reveals.
Read the full domain letter by letter, and the sender address if the code came by email.
Look the company up yourself and use its app or a number you already have.
Screenshot the message or the revealed link and ask your company's approved AI assistant whether the company is real, whether the domain matches, and whether it fits a known scam. Crop out customer and personal data, never upload attachments, and treat the answer as a second opinion.
Report it the company way, including any tampered physical code you find on site.
If money or a login was involved, call your bank to request a recall of the funds and file a complaint at ic3.gov.

At Kief Studio we build the verification into the systems themselves, so a payment or a login approval cannot go through because one person scanned one code. We also run remote team sessions on exactly this: the codes and messages your staff actually encounter and the checks that stop them. In-person sessions in Central Massachusetts are available, scoped in advance. Brian Gagne leads the security engineering, and briansgagne.com goes deeper on the technical side.

Frequently Asked Questions

What is quishing in simple terms?

Quishing is phishing with a QR code. The code hides a link to a fake login or payment page, and because people cannot read a QR code, they often do not see where it leads until the page is already open on their phone.

Why is quishing harder to catch than email phishing?

The FBI says quishing pushes victims from a work computer to a mobile device, "bypassing traditional email security controls." The link is also invisible until scanned, so the usual habit of reading a link before clicking does not apply.

Is it safe to scan QR codes on parking meters?

The FTC warned in September 2026 about QR codes on parking meters, and the FBI has warned since 2022 about criminals placing fake codes over real ones. Look for stickers or tampering, check the address after scanning, and when in doubt use the official app or website instead.

How many businesses are hit by quishing?

There is no reliable public count. No government agency or independent study we could find measures quishing on its own. The FBI's broader phishing and spoofing category drew 191,561 complaints in 2025.

Quishing

What Is Quishing? QR Code Phishing for Businesses