Why do malicious QR codes get past spam filters?

Quishing in a nutshell

‘Quishing’ is a blend of ‘QR code’ and ‘phishing’. The aim is the same as ever: to get you onto a fake page so that someone can steal a password or bank details, or make you install a malicious app. The only difference is that the malicious link is hidden inside a QR code.

The Centre for Cybersecurity Belgium (CCB) noted that 2023 was the year of the breakthrough for this technique: it first appeared in 2022 and ‘is no longer an exception’. The CCB points to the heart of the problem: when you scan a QR code, you cannot see straight away which website it will take you to.

Why the spam filter lets it through

A spam filter mainly reads the links and the text in an email. A QR code, on the other hand, is a picture. Microsoft explains this in a post by its Defender for Office 365 team: the QR code ‘appears as an image’ while the email is being delivered, and stays unreadable until it is decoded.

Microsoft gives two reasons why these attacks work, and has spotted other tricks in the emails themselves:

• The attack moves to another device. People scan with their mobile phone, often a personal one, which does not have the protection of the office computer.
• The small screen hides the warning signs. On a phone, the website address is short or cut off, and the red flags are hard to see.
• Little or no text. The fewer words there are, the fewer clues the filter has to judge the message.
• The QR code is hidden elsewhere: inside a larger image, or in a PDF attachment rather than in the body of the email.

Filters have caught up. At the end of 2023, Microsoft added QR code scanning to its email protection and said it was blocking around 1.5 million quishing emails a day. But no filter is perfect, and a QR code stuck on a charging point or printed on a letter never goes through a filter at all.

The most common traps

The fake FPS Finance refund was the subject of a Safeonweb warning in July 2026. The same goes for every public authority: they do not ask you to scan a QR code to confirm your bank details. Safeonweb has also flagged fake QR codes on electric charging points.

A typical scenario

Example, made up for illustration. One Tuesday morning, the secretary of a practice receives an email in Microsoft colours: ‘Your mailbox will be deactivated today. Scan this code to keep access.’ The email has hardly any text and no link: just a logo and a QR code. The filter does not block it.

She takes out her mobile phone, scans, lands on a perfect copy of the Microsoft sign-in page and types in her password. On the small screen, she does not see that the address has nothing to do with Microsoft. The office computer, which is protected, never saw the page.

What would have stopped her: one single rule, known by the whole team. A QR code that asks you to sign in to a work account is always a no.

What to tell your team

No need for a two-hour training session. These five sentences, repeated at a team meeting and put up near the workstations, cover the essentials. They follow Safeonweb's advice on quishing.

1. A QR code in an email is an unknown link. Same caution, same reflex: where does this message come from, and was I expecting it?
2. Never a work password after a scan. IT, Microsoft or the bank will not ask you to sign in through a QR code.
3. Read the address before opening. After the scan, the phone shows the website address: take the time to read it. If it does not match the expected site exactly, do not open it.
4. If in doubt, ask. A phone call to the colleague or the IT provider, on a number you know, never the one given in the message.
5. Report it, even if you clicked. The sooner we know, the sooner we can act. Nobody will be told off for raising the alarm.

Monday morning: four practical steps

1. Name one person to contact about suspicious messages, with their phone number, and tell everyone.
2. Show how to report: the ‘Report’ button in your email if there is one, and forwarding the email to [email protected]. The CCB also pulls out the addresses hidden in QR codes and screenshots: once a site is confirmed as malicious, anyone who lands on it is redirected to a warning page.
3. Check your own QR codes: the appointment poster in the waiting room, the payment QR code on your invoices, the link to your online reviews. A sticker placed on top? That is exactly the charging point trick.
4. Protect the accounts: multi-factor authentication on every work account, phones kept up to date, and apps installed only from the official stores (Google Play, App Store).

To go further, Microsoft recommends rolling out phishing-resistant sign-in methods widely, such as security keys or passkeys, which a fake page cannot reuse. Microsoft advises starting with administrator accounts and those with access to sensitive data: management, finance, patient records.

Someone scanned and typed something in: what to do within the hour

Don't panic, but don't wait either. What you do depends on what was given away.

For a Microsoft 365 account, changing the password is not enough. Microsoft's guide on compromised accounts also says to close sessions that are already open, remove any multi-factor authentication methods added by the attacker and check rules that forward email outside the company. That is a job for your administrator or IT provider, and it is urgent.

If money has been stolen, Safeonweb recommends filing a complaint with the police, online or at the police station. And if the attacker could see personal data (patient records, client files), the GDPR requires you to notify the Data Protection Authority of the breach (page in French) without undue delay and, where possible, within 72 hours, unless it is unlikely to pose a risk to the people concerned.

The special case of healthcare practices

In a practice, the reception mailbox receives test results, letters from colleagues and requests from patients. A stolen password gives access to all of it. So the first two rows of the table must be dealt with the same day, and you will almost always need to consider notifying the Data Protection Authority: best to discuss it with your IT provider straight away.

Keeping things in proportion

Quishing is still a variation on classic phishing, not a new kind of threat. The same reflexes protect you: be wary of urgency, check the address, never give your password to a page that turned up out of the blue. The only new thing to remember: the link can now hide inside an image, and the filter does not always protect you from it.

Better protect your email→