Quishing Explained: QR Code Phishing in 2026 (UK Guide)

What is quishing? The one-sentence answer

Quishing is phishing delivered through a QR code rather than a visible link: instead of seeing a suspicious web address sitting in the body of an email or text, the victim scans an image and is redirected straight to a credential-stealing or payment page, often on a phone with none of the warnings a desktop browser or email filter might show.

Take a realistic version of the scam the BBC identified as the UK's most frequent setting: car parks. A driver pulls into a pay-and-display space and sees a QR code on the meter, apparently for contactless payment. The code is actually a sticker, placed over the genuine one by the attacker. The driver scans it with their phone's camera and lands on a page designed to look exactly like the car park operator's payment portal. For example, a tampered car-park code could send a driver to a convincing fake payment page that steals registration, card or login details, or redirects payment to the attacker. The exact outcome depends on the scam.

How a QR-code phishing attack works: from scan to stolen data

The mechanics are consistent across almost every quishing scam, whether it starts in an email, on a poster or on a parking meter. Breaking it into stages makes clear exactly where a careful reader or employee can still stop it:

1. Placement — the attacker embeds a malicious QR image in an email, a PDF attachment, a calendar invite, or a physical sticker placed over a legitimate code.

2. Scan — the victim points their phone's camera at the code, often because the surrounding context (an invoice, a parking sign, a delivery card) makes it feel routine.

3. Preview — the phone shows a short preview of the destination address. Treat this as an initial warning check, not proof of safety: inspect the domain where possible and use the organisation's official app or a typed/bookmarked address instead of opening an unexpected QR link, since redirects, tracking domains and lookalike domains can make the true destination difficult to assess.

4. Redirect — some QR links use redirects or tracking domains, which is part of why the preview address alone (see step 3) doesn't guarantee the final destination is safe.

5. Impersonation page — the victim lands on a convincing lookalike of a brand, bank, delivery firm or payment portal.

6. Data capture — the page requests login credentials, card or bank details, or prompts an MFA approval.

7. Outcome — the attacker takes a fraudulent payment, gains account access, or persuades the victim to install a malicious app or open a malicious file.

ESET's reporting on quishing highlights step 2 as significant: scanning can move the interaction away from a managed laptop, where email gateways, browser controls and endpoint detection tools normally operate, onto a personal or work phone. Scanning can move the interaction away from desktop email and endpoint controls, potentially reducing visibility. Mobile threat defence, identity monitoring, conditional access and phishing-resistant MFA can help detect suspicious activity or limit the impact after a QR-driven login attempt; they do not make scanning safe. That reduced visibility is one reason attackers favour QR codes over plain text links.

The QR scams people are seeing: parking, parcels, payments, email and physical stickers

Not every QR code carries the same risk, and the warning signs differ by channel. The table below separates the main delivery methods and the single most useful thing to check for each.

QR codes in emails and PDF attachments are a growing problem: secondary reporting says malicious QR codes appeared in 65% of analysed malicious PDF attachments in January 2026 and 70% in March. The figures are consistent with increased use of QR-bearing attachments and may exploit limits in text-based scanning; they do not by themselves prove attacker intent, and they are not a measure of all PDFs. ESET separately found that around 11% of the phishing emails it detected in H1 2026 used a QR code rather than a conventional link.

Physical codes carry a different risk profile. The NCSC specifically flags open, unsupervised locations — stations and car parks — as higher-risk than a QR code on a restaurant or pub menu, because a sticker can be slapped over an official code with nobody noticing. That distinction matches what the BBC found in UK fraud reports: car parks were the most frequently cited setting.

How common is quishing? UK and global figures for 2026

Report Fraud received 2,743 reports mentioning QR codes in the 12 months ending August 2026, compared with 341 in the 12 months ending August 2022 — an increase of about 704%, which the BBC describes as roughly 700%. The trend direction is unambiguous, as outlined above.

Global detection figures measure something different again: the volume of QR-bearing phishing emails a security vendor's systems flagged, not the number of people affected. Secondary reporting on Microsoft's phishing analysis puts QR-phishing attack volumes in its telemetry at 7.6 million in January 2026, rising to 18.7 million in March 2026 — a 146% increase over the quarter — before falling for three consecutive months to 8.3 million in June 2026. These are monthly detection/volume figures, not unique-victim counts, and they are drawn from secondary reporting rather than a primary Microsoft publication, so they should be read as directional evidence of a spike-and-decline pattern rather than a precise tally of attacks or victims.

In ESET's H1 2026 telemetry, the United States represented 19% and Spain 17% of QR-phishing detections — shares of ESET's own detections, not national victimisation rates. No equivalent UK percentage share was found in the available research, which is why the UK picture here relies on the Report Fraud reporting numbers rather than vendor detection telemetry.

These two data sources — UK Report Fraud reports and vendor telemetry from Microsoft or ESET — measure different things and cannot be compared directly: one counts reports made by UK members of the public and businesses, the other counts automated detections across each vendor's global customer base. Neither is a reliable proxy for the total number of people affected by quishing.

How to check a QR code safely before opening the destination

A QR code is an encoded data pattern that often contains a web address; in quishing, attackers use it to conceal a malicious URL. Scanning it tells your phone where to go, but it tells you almost nothing about whether that destination is genuine. As above, treat the phone's preview address as an initial warning check only, not proof of safety, and use the organisation's official app or a typed/bookmarked address instead of opening an unexpected QR link.

This is also why a familiar logo, a visible domain name, or even a padlock and HTTPS in the address bar prove nothing on their own. HTTPS only confirms the connection to that particular server is encrypted — it says nothing about who controls the server or whether the page is a lookalike. Attackers routinely register domains that look close enough to the real brand name to pass a quick glance.

The NCSC's practical advice is to use the QR-scanning function built into the phone's own camera app rather than downloading a separate third-party QR-scanner app, since that avoids granting an unnecessary app extra permissions. Before opening a destination reached from an unexpected QR code — in an email, on a poster, or on a parking meter — go directly to the organisation's official app or a web address you've typed yourself, rather than trusting the scanned link. If a code looks like it has been stuck over an existing sign, don't scan it at all; report the suspected tampering to the operator, facilities team or security function responsible for that location.

What to do if you've scanned, entered details or paid

What happens next depends entirely on how far the interaction went. Treat these as separate branches rather than one generic response:

Opened the page but entered nothing: close the browser tab, don't enter any information, and avoid returning to that page from the same link. If it was work-related, report it through your employer's security process — phishing and staff training materials usually cover exactly this kind of hesitate-and-report step.

Entered login credentials: change the password immediately on the real site reached independently, not via the scanned link, and review recent account activity. If this was a corporate account, or you approved an unexpected MFA prompt, contact your employer's security team immediately and ask them to revoke active sessions or tokens where the organisation supports that. Where the account supports it, move to phishing-resistant MFA rather than a code that can be relayed by an attacker in real time.

Entered card or bank details, or authorised a payment: contact your bank immediately to flag the transaction and, where relevant, request a chargeback or dispute. In England, Wales and Northern Ireland, report the scam to Report Fraud (reportfraud.police.uk), the UK's national fraud-reporting service that replaced Action Fraud in December 2025, and whose data shows the 2,743 QR-related reports logged to August 2026. In Scotland, report fraud to Police Scotland by calling 101.

Installed an app from a scanned link: disconnect the device from work systems if appropriate, and for a corporate device contact IT or the security team immediately rather than acting alone. Use the device's built-in security tools and follow the vendor or platform's malware-removal guidance — for example checking unfamiliar permissions, subscriptions or charges — before uninstalling the app, since removing it too quickly can lose evidence needed to understand what happened.

In every case, report the incident — whether through Report Fraud (or Police Scotland in Scotland) for personal fraud, or an employer's incident process for a work device — so the pattern (a particular car park, a particular email template) can be flagged to others before it catches someone else.

Quishing versus ordinary phishing: what changes and what stays the same

Quishing is not a new type of fraud — it is ordinary phishing's psychology (urgency, authority, a plausible pretext) delivered through a different channel. The core difference is that a traditional phishing link can be inspected by a corporate email gateway, URL rewriting or endpoint detection tool before the user clicks, as described above; a QR code moves that same click onto a phone camera, reducing that inspection.

The more significant difference is what quishing enables next: it can act as the opening move in a longer social-engineering chain. The NCSC notes that an email quishing attempt can be followed by a smishing text or a vishing phone call, particularly when the attacker needs the victim to read out a one-time code or approve a login they didn't start. A QR code, a follow-up text, and a convincing phone call are often three stages of the same fraud, not three unrelated incidents.

Organisational controls: a checklist for UK IT and security teams

For UK IT buyers, quishing is as much a procurement question as a staff-training one. When evaluating or renewing an email-security or secure email gateway (SEG) product, ask explicitly whether it inspects QR codes embedded in message bodies, images and PDF attachments — not just text-based URLs — since this is precisely the gap attackers are exploiting. Because the interaction then moves to a mobile device, the same buying conversation should extend to mobile device management (MDM), conditional access and identity platforms: ask whether conditional access policies can require additional verification after a credential phish reached via a QR code, and whether the identity platform's telemetry can flag unusual sign-ins following a reported QR-code incident so sessions and tokens can be revoked quickly. Vendors offering phishing-resistant MFA (such as passkeys or hardware keys) should be asked specifically whether their approach blocks relay of a one-time code entered after a QR-driven login page, since that is the scenario quishing is designed to exploit.

Staff guidance still matters, but it should sit alongside these procurement checks rather than replace them: guidance should be explicit about where tampered codes turn up in practice — parking meters, car parks, stations, posters and replacement stickers — not just inbox messages, and should instruct staff to verify any login page reached via a QR code through a known bookmark or typed address rather than the scanned link itself.

• •Ask email-security/SEG vendors whether they inspect QR codes in message bodies, images and PDF attachments, not just visible text links
• •Ask MDM and mobile threat defence vendors how they cover phones used to scan work-related QR codes
• •Confirm conditional access policies require additional verification after a credential phish originating from a QR code
• •Ask MFA vendors whether their phishing-resistant method (e.g. passkeys or hardware keys) blocks relay of a code entered via a QR-driven login page
• •Confirm identity telemetry can flag unusual sign-ins following a reported QR-code incident, with a fast path to revoke sessions or tokens
• •Brief staff explicitly on physical locations — car parks, stations, posters, replacement stickers — not only email

The five-second verdict: when to scan and when to stop

Many QR codes are legitimate, but context matters: codes in supervised settings such as restaurants may be lower risk than codes in open, unsupervised locations such as car parks or stations. Still check the destination before entering sensitive information. Before scanning, ask one question: did I go looking for this code, or did it come looking for me? A code stuck to a parking meter, printed in an unsolicited email, or taped over a poster is not something you sought out — treat it with proportionate suspicion.

If scanning leads to a request for a login, a card number, a bank transfer or an app install, stop and verify independently: reach the organisation through its official app or a web address you type yourself, never through the page the QR code opened. For organisations building this into security awareness training, the message to staff should be explicit and sit alongside email security protection controls: a QR code is not a shortcut to trust just because it looks official — it's a shortcut around the checks that usually catch a fake link.

Sources

Every figure in this article traces to the sources below.

• •National Cyber Security Centre — QR code risk guidance, car park/station warnings, scanning advice
• •National Cyber Security Centre — staff phishing/scam spotting guidance
• •BBC — UK Report Fraud QR-code report figures, 2022 vs 2026, car park prevalence
• •Cambridge Network — 146% quarterly increase figure, verification advice
• •ESET — H1 2026 QR-phishing share of detected emails and geographic detection shares
• •QR Code Press — secondary reporting of Microsoft QR-phishing detection figures and PDF attachment share
• •CloudSEK — June 2026 QR-phishing detection figure