"Quishing" is phishing delivered through a QR code. Because you can't visually inspect where a QR code leads the way you can hover over a link, scammers use them to smuggle malicious URLs past your instincts. They appear on "we're hiring" flyers in cafés and on campus, in emails claiming to link to an application or offer letter, and on posters promising quick remote work.
Scan it, and you land on a credential-phishing page, a malware download, or a form harvesting your personal data — the same payloads as email phishing, just through a channel that hides the destination.
Why QR codes are effective for scammers
A QR code is opaque by design: the destination is encoded, not written. On a phone, tapping through is frictionless, and the small screen makes it easy to miss a look-alike domain. QR codes also sail through many email filters that would flag a suspicious text link, and printed codes can be stickered over legitimate ones in public places.
How to scan safely
Most phone cameras show a URL preview before opening — read it, and confirm it's the real company domain before tapping. Be suspicious of QR codes on unsolicited flyers or emails, especially for jobs. When you can, skip the code entirely and navigate to the company's careers page by typing the address yourself.
Red flags to remember
- A QR code as the only way to "apply" or "claim" a job
- QR codes on unsolicited flyers, posters, or emails
- A preview URL that isn't the real company's domain
- Urgency to scan and act ("limited spots," "scan before it expires")
- A stickered or pasted-on code covering original print
What to do if you're targeted
- 1Don't scan unsolicited QR codes; type the company's URL instead.
- 2If your camera shows a preview, verify the domain before opening.
- 3If you entered credentials, change passwords and enable 2FA.
- 4Report the flyer/email and, if on premises, notify the venue.
Frequently asked questions
Is it dangerous to just scan a QR code?
Scanning to preview the URL is generally low-risk on modern phones; the danger is tapping through to a malicious site and entering data or downloading a file. Always read the preview and verify the domain first.