QR code phishing — "quishing" — has grown alongside the everyday use of QR codes for menus, parking, payments, and physical mail. It exploits a specific blind spot: most email and SMS filters scan text for malicious links, but a QR code is an image, not text.
Why Quishing Bypasses Traditional Filters
A URL embedded as a QR code image is invisible to link-scanning tools that only parse message text. It's also invisible to the user until they scan it — often on a personal mobile device, off the corporate network entirely, which removes it from the visibility of most enterprise security tooling altogether.
Detecting Quishing with Computer Vision
Detection requires actually decoding the QR code from the image before the user does: extracting the embedded URL via computer vision, then running that URL through the same real-time destination analysis used for any other link — checking domain age, hosting reputation, and visual similarity to known login pages — before the message reaches the user, or as the code is scanned on-device.
Where Quishing Shows Up
Beyond email, quishing appears in physical contexts that are harder for any enterprise tool to monitor: fraudulent QR stickers placed over legitimate ones on parking meters or posters, and QR codes embedded in printed mail. On-device mobile scanning extends coverage to these physical-world vectors, since the analysis happens at the point the code is scanned rather than relying on network-level filtering.
Frequently Asked Questions
Can standard email security tools detect quishing?
Only if they specifically extract and analyze the URL encoded inside the QR image — text and link scanners that don't process embedded images will miss it entirely.
Is quishing only an email problem?
No — it also appears in physical contexts (posters, parking meters, printed mail) and other digital channels, which is why on-device mobile scanning matters alongside email-layer detection.