What is quishing? Phishing hidden in a QR code, so nobody can read the link before scanning. The FBI warned in January 2026 that quishing pushes victims from work computers to phones, past email security controls.
What is quishing? Quishing is phishing through a QR code: the scam link is hidden inside the code, so the person scanning it cannot see where it leads until their phone opens it. The FBI describes quishing as embedding malicious links in QR codes "to force victims to pivot from their corporate endpoint to a mobile device, bypassing traditional email security controls."
That definition comes from an FBI FLASH alert issued in January 2026. It extends everything in how phishing actually works and how to spot it to a format people cannot read with their own eyes, and it shows up in places most security training never mentions: invoices, parking meters, posters, and PDFs.
A QR code solves the scammer's biggest problem with an emailed link: the link is visible. A person can hover over it, read the domain, and notice that something is off. A code is a pattern of squares that tells a human nothing.
The second advantage is the device switch. The FBI's wording is precise: the code pushes the victim from a managed work computer to a phone, where the company's email security controls no longer see it. The scan happens on the device with the smallest screen and, often, the least oversight.
I study behavioral psychology, and QR codes carry a learned trust. Restaurants, ticketing, and payment apps taught everyone that scanning is normal and safe. Quishing borrows that habit and points it somewhere else.
In email and attachments first. The FBI's January 2026 alert concerned a North Korean group sending QR codes to think tanks, academic institutions, and government organizations, with the codes leading to fake login pages.
The FTC's December 2023 alert gives the plain rule for email: "Don't scan a QR code in an email or text message you weren't expecting." That applies to a code on a PDF that claims to be a payroll update, a shared document, or a voicemail notice.
Physical codes are the second route. The FBI's January 2022 PSA, "Cybercriminals Tampering with QR Codes to Steal Victim Funds," described criminals placing their own codes over legitimate ones. The FTC returned to the theme in September 2026 with a warning about QR codes on parking meters. For a business, that means the lobby sign, the conference badge, the delivery slip, and the code on a vendor's truck.
Invoices are the third, and the one that touches finance. A code that promises a fast way to pay can lead to a payment page the vendor never set up. That is the same goal as business email compromise, delivered in a format your accounts payable team may not think to question.
No reliable public count exists. I have not found a government figure or independent research measuring quishing on its own, and the numbers that circulate tend to come from security vendors describing their own customers. Rather than borrow one of those, this article leaves the number out.
What the FBI does publish is the size of the wider category. The IC3 2025 Internet Crime Report recorded 191,561 phishing and spoofing complaints in 2025, more than any other crime type. The FBI defines that category as unsolicited email, text messages, and phone calls asking for personal, financial, or login details, so QR codes sent by email or text fit within it, though the report does not count them separately.
The useful question for an operator is a different one: where do QR codes enter your business processes, and can any of them move money or credentials? That inventory is usually short, and it is where the controls belong.
The FBI's 2022 PSA lists the core habits. Check the web address after scanning and before opening it. Look for stickers or signs of tampering on physical codes. Do not download apps from a QR code, do not use a third-party scanner app, and type payment addresses in manually rather than scanning them.
The FTC adds a judgment call: "If you see a QR code in an unexpected place, inspect the URL before you open it." Read the domain letter by letter, the way you would for an emailed link, and close the page if it asks you to sign in or pay.
For anything that leads to a login, the safest habit is to skip the code. Open the app or type the company's address yourself. The code saves a few seconds, and those seconds are exactly what the scammer is counting on.
Assume someone will eventually scan the wrong code, and design so that it does not matter much. The strongest control is phishing-resistant MFA. CISA calls it "the gold standard" and names FIDO/WebAuthn as the only widely available form. NIST defines phishing resistance as protection that works "without reliance on the vigilance of the claimant," which is the right standard when the threat is a code nobody can read.
Push approvals are weaker, for the reasons covered in what is MFA fatigue.
On the finance side, write one rule into the payables process: invoices are never paid by scanning a code. Payments go through the portal or bank details on file, verified by phone when anything changes. Email security beyond "don't click the link" covers the wider set of controls that keep a single message from deciding an outcome, and what is smishing covers the text-message route many QR scams arrive by.
When a code, message, or page asks you to sign in or pay, run through these steps. The full method is in how to check if a message is a scam.
At Kief Studio we build the verification into the systems themselves, so a payment or a login approval cannot go through because one person scanned one code. We also run remote team sessions on exactly this: the codes and messages your staff actually encounter and the checks that stop them. In-person sessions in Central Massachusetts are available, scoped in advance. Brian Gagne leads the security engineering, and briansgagne.com goes deeper on the technical side.
Quishing is phishing with a QR code. The code hides a link to a fake login or payment page, and because people cannot read a QR code, they often do not see where it leads until the page is already open on their phone.
The FBI says quishing pushes victims from a work computer to a mobile device, "bypassing traditional email security controls." The link is also invisible until scanned, so the usual habit of reading a link before clicking does not apply.
The FTC warned in September 2026 about QR codes on parking meters, and the FBI has warned since 2022 about criminals placing fake codes over real ones. Look for stickers or tampering, check the address after scanning, and when in doubt use the official app or website instead.
There is no reliable public count. No government agency or independent study we could find measures quishing on its own. The FBI's broader phishing and spoofing category drew 191,561 complaints in 2025.
What is pretexting? An invented story that makes a request for money, data or access feel routine. Verizon's 2026 DBIR found a human element in 62% of breaches. Why conscientious people get caught, and how callbacks stop it.
What is smishing? Phishing by text, aimed at the phone in every employee's pocket. Imposter scams were the most-reported fraud to the FTC in 2025, with $3.5 billion lost. Here is what work-targeted texts look like and how to report them to 7726.
Phishing isn't just bad grammar in a Nigerian prince email anymore. AI-generated phishing is personalized, grammatically perfect, and harder to spot than ever.
Work With Us
Kief Studio builds, protects, automates, and supports full-stack systems for businesses up to $50M ARR.
Newsletter
Strategy, psychology, AI adoption, and the patterns that actually compound. No spam, easy to leave.
Subscribe
