QR code phishing, and why it arrives by email
What is QR code phishing?
QR code phishing, or quishing, is ordinary phishing with the link moved into a picture. The email carries a code instead of a URL, so a mail filter scanning text for known-bad addresses finds nothing to object to. The reader scans it with a phone and lands on a fake login page.
That is the entire innovation, and it is worth being precise about it, because it explains every other thing the attack does.
Why the code exists at all
A mail gateway is good at reading text. It compares every link against reputation lists, rewrites some, and blocks others. It is not good at reading pictures, and it does not follow a code it cannot decode. So the code is not there to be convenient. It is there because it is the one part of the message the filter cannot inspect.
The second effect matters as much. A code has to be scanned with a camera, and the camera is usually on a personal phone rather than the managed laptop. That moves the victim off the corporate network, past the endpoint protection, and onto a small screen where a long address is truncated. The attack is not just evading the filter, it is choosing the device.
How to spot one
- An email whose action is a picture. Legitimate senders link. A code in an email, especially one asking you to re-authenticate, is the shape of the attack.
- Urgency about access. Expiring multi-factor enrolment, a mailbox about to be closed, a document that will be deleted. The pressure exists to stop you checking.
- Read the banner, then read the domain from the right. Both iPhone and Android show the destination before loading it. The real host is what sits immediately before the first slash, so
klipqr.com.evil.example/loginis onevil.example. - Never sign in from a scan. If a code leads to a login page, close it and reach the service the way you normally would. This one habit defeats the entire category.
A code cannot carry a virus
Worth saying plainly, because the fear is common and misplaced. A QR code is a way of writing text, and text does not execute. Everything harmful happens after the address opens. The code is an envelope, and the danger is what the envelope points at.
What a shortener should be doing about it
Short links are useful to attackers for the same reason they are useful in print: the destination is not visible until it is followed. So the fair question to ask any provider, including this one, is what stands between an attacker and a working link.
Two things here, and both are checkable rather than claims. There is no anonymous link creation: an account with a verified email address is required before any link resolves, which is a security control wearing a product-feature label. And destinations are screened against Google Web Risk before a link is issued to an untrusted account; if that screening is unavailable, creation is refused rather than waved through, because a shortener that fails open is exactly the tool this article is about.
A reported link stops resolving worldwide within about thirty seconds, everywhere it was printed, which is the one thing a dynamic code can do that a static one cannot. If you have received one of ours, report it.
The other attack, which is not this one
Quishing arrives in your inbox. The other QR attack arrives on a wall: a sticker pasted over a real code on a parking meter or a table tent, where the victim never chose to trust a message at all. Different attacker, different defence, and the defence belongs to whoever printed the original. We wrote that one up separately in the sticker attack.
Questions
The things people ask before they commit something to paper.
What is QR code phishing called?
Quishing, a contraction of QR and phishing. The name is worth knowing mostly because security vendors use it and you will meet it in a policy document, but the attack is ordinary phishing with the link moved into an image.
How does QR code phishing work?
The attacker sends an email whose call to action is a picture rather than a link, usually framed as re-authenticating an account or viewing a document. The mail gateway scans text and attachments for known-bad addresses and finds none, because the address is inside the image. You scan it with a phone, which is often outside the protection your employer controls, and land on a convincing login page.
Can a QR code itself contain a virus?
No. A QR code is a way of writing text, and text cannot execute. Everything dangerous happens after the address is opened: a fake login page, a prompt to install something, or a payment request. Treat the code as an envelope rather than the thing inside it.
How do I check where a QR code goes before opening it?
Both iPhone and Android show the destination as a banner before loading it. Read that banner, and read the domain from the right: everything up to the last dot before the first slash is the real host, so a link at klipqr.com.evil.example is on evil.example. If a code arrived by email and asks you to sign in, stop and reach the service the way you normally would.
Are short links in QR codes a red flag?
They are a reason to read the banner rather than a reason to panic. A short link hides its destination by design, which is useful for print and useful to an attacker. What separates providers is whether anyone can mint one anonymously and whether destinations are checked at all. Both are fair questions to ask of any shortener, including this one.