What Is Quishing (QR Code Phishing)?

Quishing (QR code phishing) uses a QR code instead of a clickable link to direct a victim to a fraudulent destination. The code might be printed on a flyer, pasted over a legitimate parking or payment sticker, embedded in an email attachment, or shown on a fake delivery notice.

Because the underlying URL is encoded inside the image rather than visible as text, people have no easy way to inspect where a QR code leads before scanning it — which is exactly what makes it an attractive channel for attackers.

Many existing email and web-security tools are built to scan visible URLs in text and HTML. A malicious link hidden inside a QR code image can pass through those filters untouched, and the scan typically happens on a personal mobile device, outside of any corporate or carrier security layer.

This combination — low visibility and a weaker security perimeter on the scanning device — is why quishing has grown alongside ordinary phishing rather than replacing it.

DefenceNet’s URL-analysis models evaluate the destination a QR code resolves to using the same structural, brand-impersonation, and zero-day detection signals applied to any other suspicious link — so a malicious destination can be flagged whether it was reached through a tapped link or a scanned code.

This is designed to be delivered through the DefenceNet mobile app, embedded SDK, and enterprise integrations, so QR destinations can be checked before a customer reaches the fraudulent page.