Guide · Phishing

QR Code Phishing (Quishing): How Small Businesses Stop It

By Christopher Smith, penetration tester·Published October 14, 2026·Updated October 15, 2026·4 min read

QR codes skip the step where you see a link before you visit it. That is exactly why criminals like them. A fake code taped over a real one on a parking meter, a QR code in an “invoice overdue” email, or a code on a surprise package can all send your staff to a convincing fake login or payment page. This kind of phishing is called quishing.

This guide covers how quishing works, what US government agencies (FTC, FBI, and CISA) recommend, and a short policy you can give your team today.

Quick verdict

• Train people to treat unexpected QR codes like unexpected links — verify the destination before signing in or paying.
• Prefer the controls that stop damage after a bad scan: password manager + MFA, unique passwords, and fast offboarding — not posters alone.
• Publish a one-paragraph policy so staff know when a QR code is legitimate at work (for example only codes you print or display yourselves).
• Do not rely on “looks official.” Quishing works because the code is on a real-looking flyer, parking sign, or email.

How quishing works

• Tampered physical codes. The FBI warned in 2022 that criminals were tampering with QR codes on physical surfaces to send people to malicious sites that steal login and financial information (FBI IC3 public service announcement). The FTC has described scammers covering parking-meter codes with their own (FTC consumer alert).
• QR codes in email. A QR image in an email is harder for email filters to inspect than a normal link, and it moves the victim from a managed work computer to a personal phone. The FBI describes this tactic in a 2026 advisory on QR-code spearphishing aimed at US organizations (FBI advisory, PDF).
• Urgency stories. The FTC lists the usual pretexts: a package that couldn’t be delivered, a problem with your account, or “suspicious activity” that requires a password change. All are designed to make you scan without thinking.

For a small business, the targets are usually Microsoft 365 or Google Workspace logins, banking, and payment pages.

What the FTC, FBI and CISA recommend

For everyone on your team

• Preview the link before opening it. Most phone cameras show the web address before you tap it. Check for misspellings, swapped letters, and unfamiliar domains (FTC).
• Don’t scan codes in unexpected emails or texts, especially ones that demand immediate action. If the message might be real, contact the company through a phone number or website you already know (FTC; CISA: recognize and report phishing).
• Check physical codes for tampering, such as a sticker placed over the original, and pay through the official app or website instead when you can (FBI).
• Never enter a password or payment details on a page you reached by QR code unless you have verified the address. Type the site yourself instead.
• Keep phones updated and use strong passwords plus multi-factor authentication (FTC).

For the business

The FBI’s 2026 advisory recommends these organization-level steps:

• Train staff about unsolicited QR codes from any source: email, letters, flyers, or packaging.
• Have staff verify QR sources through a second channel before entering credentials or downloading files.
• Set a clear way to report suspicious QR codes.
• Use mobile device management (MDM) or mobile security tools that can check QR-linked URLs.
• Require phishing-resistant MFA for remote access and sensitive systems.

CISA, NSA, FBI and MS-ISAC’s joint phishing guidance (PDF) includes a section written specifically for small and medium-sized businesses. Its core advice applies directly: phishing-resistant MFA is the main defense against credential phishing, whatever the delivery method.

The controls that actually stop the damage

Training helps, but someone will eventually scan a bad code. These controls limit what happens next:

1. Phishing-resistant sign-in. Passkeys and security keys only work on the real site, so a stolen password from a fake page isn’t enough on its own. See our Microsoft 365 MFA guide.
2. A password manager with autofill. A password manager fills your login only on the exact website it was saved for. When it refuses to fill on a QR-linked page, that is a strong warning sign. Our password manager guide compares team options. One option is NordPass TeamsAffiliate.
3. Email authentication on your own domain, so criminals cannot send QR “invoices” that appear to come from you. See our SPF, DKIM and DMARC guide.
4. Updated phones. Turn on automatic updates (see what to turn on).

A one-paragraph policy for your team

If someone already scanned and entered details

1. Change the password immediately, and anywhere else it was reused. Sign out other sessions.
2. Check the account for new MFA methods, forwarding rules, or login alerts you don’t recognize.
3. If payment details were entered, call the bank or card issuer.
4. Report it to the FTC at ReportFraud.ftc.gov, and to the FBI at IC3.gov if money was lost.

Bottom line

Treat a QR code like any other link: preview it, verify unexpected ones through a second channel, and never type a password on a page a QR code brought you to. Back that habit with phishing-resistant MFA and a password manager, so one bad scan doesn’t become a breach.