QR Code Phishing (Quishing): How to Spot It and Stay Safe

An office manager at an architecture firm in Ottawa gets an email: "Your multi-factor authentication expires today. Scan the QR code to reactivate it." A familiar logo, a crisp QR code, no link to click. She pulls out her phone, scans it and types her password into a page that looks exactly like the real one.

The spam filter didn't notice a thing: there was no suspicious link, only an image. And her personal phone had none of the protections on her work computer.

That's quishing, or QR code phishing. Here's how to recognize it, the rules to give your team and the settings that limit the damage.

What is quishing?

Quishing is phishing that uses a QR code instead of a clickable link to send the victim to a fake sign-in or payment page.

In its ITSAP.00.141 publication, updated in January 2024, the Canadian Centre for Cyber Security describes three approaches: cloning an authentic QR code to redirect people to a malicious site, putting a QR code in a phishing email, or placing a fake code in a public space. The Canadian Anti-Fraud Centre also lists "instructions to scan a QR code" among common phishing tactics.

The goal is the same as any phishing: steal a password, an MFA code or a card number, or get you to install a malicious app.

Why QR codes get past our reflexes

A QR code gets around two protections at once: link scanning in email and the company-managed computer.

• It's an image. Some email filters analyze links but don't necessarily decode an image or a PDF. Ask your IT provider what yours does.
• The scan happens on a phone. Often a personal device, without the protections, updates or monitoring of a work computer.
• The address is hard to read. On a small screen, a slightly altered URL slips by.
• Habit breeds trust. Restaurant menus, parking, invoices: scanning has become routine.

The classic warning signs still apply: urgency, threats to lock the account, an unexpected sender. Our article with phishing email examples covers them in detail.

Where you'll run into it: email, invoices, parking

Quishing mostly shows up in three places: emails and attachments, payment requests, and physical codes stuck up in public spaces.

Parking is the most publicized case in Canada. In April 2026, the City of Mississauga removed roughly 80 fraudulent QR code stickers from its parking machines, stated that "any QR code found on a City paid parking machine is not legitimate," and noted similar scams in Vancouver, Montréal, Ottawa and Toronto. In July 2025, Montréal's parking agency warned about a fake QR code on one of its signs, telling Noovo Info that its signs had never carried QR codes.

For a small business, the last row of the table matters most: if your customers scan your codes, a scammer can stick theirs on top.

The rules to give your team

One simple rule covers most of it: never sign in to a company account, and never pay for anything, from a QR code you didn't ask for.

Most of the other guidance comes from the Canadian Centre for Cyber Security:

• For Microsoft 365, Google Workspace or the bank, type the usual address or use a bookmark, never a QR code from an email.
• If a page asks for a password after a scan, carefully check the site's address.
• Use the phone's built-in camera or a trusted reader, not an app from an unknown company.
• Set the phone to ask permission before launching a QR code's action.
• Be wary of a sticker that might cover another code, and ask staff on site to confirm it.
• Keep the phone updated, with automatic updates turned on.
• Report any email with a suspicious QR code, without scanning it.

Add a clear internal message: "IT will never ask you to scan a QR code to reactivate your account."

The technical measures that limit the damage

The most effective measure is phishing-resistant authentication: if the account requires a passkey or a FIDO2 security key, a stolen password isn't enough, and the fake page can't relay the key, which is bound to the real domain.

Our passkey deployment guide explains how to get there, and our MFA methods comparison shows why text messages and six-digit codes don't protect against a fake page.

Then:

• Email filtering: check with your provider whether scanning covers QR codes in images and attachments.
• Conditional access: block sign-ins from unknown devices or from countries where you have no staff.
• Mobile devices: if employees read work email on their phones, manage those devices (updates, screen lock, app protection).
• Simulations: add a QR code scenario to your security awareness exercises.
• Your domain: scammers can send quishing emails to your customers in your name. Check your protection with our DMARC, SPF and DKIM checker.

I scanned and entered my password: now what?

Change the password immediately from another device, then tell IT so they can revoke active sessions.

1. Check that no new MFA method was added to the account.
2. Look for forwarding or deletion rules added to the mailbox.
3. If you entered a credit card, call your financial institution.
4. For a parking code, also report it to the city or parking authority (in many cities, by calling 311).
5. Report the fraud to the Canadian Anti-Fraud Centre.

Our article I clicked a phishing link: what to do walks through each step, including whether you have a privacy breach to record or report.

To confirm that your email filtering, MFA and conditional access are set up properly, our Microsoft 365 and Google Workspace audit reviews those settings.