QR codes are on restaurant tables, parking meters, package slips, and conference badges, and most of us scan them without a second thought. Attackers noticed. Quishing, short for QR code phishing, hides a malicious link inside a QR code so the victim cannot read where it goes until it is too late. In its email threat report for the first quarter of 2026, Microsoft called the rapid rise of QR code phishing the most significant shift of the quarter, with monthly attack volume climbing from 7.6 million in January to 18.7 million in March.
This guide explains how a quishing attack works, shows documented examples from parking meters in the South Bay to fake MFA notices, explains why email filters struggle with it, and lays out the training and technical controls that stop it. At the end there is a short paragraph you can print and post in the break room.
How a QR code phishing attack works, from scan to stolen session
The code arrives in one of three ways: pasted into the body of an email, tucked inside an attachment, or printed on a sticker in the physical world. Microsoft found that PDF attachments were the main delivery method in early 2026, carrying 70 percent of QR code attacks by March. The message gives a reason to scan right now, such as a document waiting for signature, an expiring password, or a security check.
What happens next is described in an FBI FLASH alert from January 8, 2026. After the scan, the victim's phone passes through attacker controlled redirectors that record details like the operating system, IP address, language, and screen size, then shows a sign in page built for mobile that imitates Microsoft 365, Okta, or a VPN portal. The FBI says these operations frequently end with session token theft, which lets attackers get past multifactor authentication without triggering the usual "MFA failed" alerts. From there they set up persistence and send more phishing from the victim's real mailbox.
Real quishing examples, from Redondo Beach parking meters to fake MFA notices
The physical version reached Los Angeles County in August 2024, when Redondo Beach warned drivers that fake QR stickers had been placed on about 150 parking meters along the Esplanade and in Riviera Village. ABC7 reported that the codes led to a look alike payment site and that police inspected every meter and removed them. The Federal Trade Commission had already warned in a December 2023 consumer alert that scammers were covering parking meter codes with their own, and sending QR codes by email and text with stories about failed package deliveries, account problems, or suspicious activity that required a password change.
In the workplace, the favorite disguise has been security itself. Trustwave SpiderLabs researchers reported in August 2023 that the quishing samples they saw were primarily disguised as multifactor authentication notifications, some carrying the victim company's own logo and some hidden in PDFs. Microsoft's own Defender for Office 365 datasheet lists a password reset or a two factor authentication request as typical lures. The FBI's 2026 alert adds targeted versions from May and June 2025: a "questionnaire" from a spoofed foreign policy adviser, a "secure drive" offered by a fake embassy employee, and a conference registration page that led to a fake Google sign in. Each one is classic social engineering with a camera added.
Why email filters miss QR codes
Traditional filters are very good at reading links in text. A QR code is a picture, and the link inside it does not exist until something decodes the image. The FBI notes that QR images delivered as attachments or embedded graphics can evade URL inspection, link rewriting, and sandboxing. Microsoft has responded by extracting URLs from QR codes during mail flow and checking them like any other link, and its datasheet says that capability pushed attackers to change tactics. Attackers keep adapting, and by early 2026 most QR attacks Microsoft saw arrived inside PDFs.
The bigger gap is the phone. The scan moves the victim from a managed work computer, with endpoint protection and web filtering, to a personal device that often has neither. The FBI describes this as a compromise path that starts outside normal endpoint and network inspection. Good email security catches much of it, but no filter catches everything, which is why people and sign in controls have to carry the rest.
QR code phishing training that changes what people do
The core lesson fits in one sentence: a QR code is a link you cannot read, so treat it with the same suspicion as a link from a stranger. Teach staff never to sign in, reset a password, or approve anything after scanning a code from an email. If a message says your MFA needs attention, go to the Microsoft sign in page yourself or call IT. The FBI recommends verifying QR code sources through a separate channel, such as calling the sender, especially before entering credentials.
Make reporting easy and praised. People who report a suspicious message within minutes give IT a chance to pull it from every other inbox, so show them how to report phishing in Outlook and thank them publicly when they do.
Then practice. Include QR code lures in your phishing simulations, because people learn to pause by pausing, not by reading a policy.
Technical controls that back up the training
Start with the email layer. If you use Microsoft 365, apply Microsoft's recommended Defender for Office 365 settings and turn on Safe Links, Safe Attachments, and zero hour auto purge, which Microsoft lists in the same Q1 2026 report. Then strengthen sign in. The FBI recommends phishing resistant MFA for all remote access and sensitive systems, and it is the control that matters most here, because methods like FIDO2 keys, passkeys, and Windows Hello for Business are tied to the real site and cannot be relayed through a fake page. Our guide to phishing resistant MFA covers the rollout.
Finally, close the phone gap. The FBI recommends mobile device management or endpoint security that can analyze QR linked URLs before allowing access. Pair that with Conditional Access rules that limit company data to managed devices, and with alerts on unusual sign ins. If staff use personal phones for work, our article on BYOD security risks explains how to protect company data without taking over anyone's phone.
A one paragraph QR safety poster for your break room
Think before you scan. Treat every QR code like a link you cannot read. Never scan a code from an email or text to sign in, reset a password, set up MFA, pay a bill, or open a shared file; go to the website or app yourself instead. Look at stickers on parking meters, signs, and menus for a label pasted over the original, and pay for parking through the official app. When your phone shows the web address, read it before you tap, and close it if anything looks wrong. If you scanned a code and then typed a password, call IT right away. A fast call is never a bother, and it can stop an attack in minutes.
How GlobeVM helps
For 30 years GlobeVM has protected Los Angeles businesses, and today we support more than 75 organizations across Southern California. Email filtering, endpoint protection, firewall management, and MFA are standard in every plan, and we monitor around the clock. Our security awareness training helps staff build these habits, and our team works in English and Farsi. If someone scans the wrong code, a person in Los Angeles answers in under 15 minutes, often George or Nazy, the owners.
Curious how well your domain resists spoofing? Try our free email security check.
Then call (818) 405-9930 or schedule a free IT assessment.