# QR codes in phishing emails

> Phishing emails use QR codes for two reasons. Filters that inspect URLs cannot read a link hidden inside an image, and scanning moves the victim from a protected work computer to an unmanaged personal phone. Treat any emailed QR code — especially MFA or payroll lures — as hostile until decoded.

Source: https://useqr.app/docs/security/qr-codes-in-phishing-emails · Last reviewed 2026-08-21 · UseQR is free forever, MIT licensed, no signup.

---

## The two-step evasion

An emailed QR code is not a gimmick — it defeats two layers of defence in one move, which
is why [quishing](/glossary/quishing) campaigns lean so heavily on email.

**Step one: the filter cannot see the link.** Secure email gateways parse text. They
rewrite URLs, check them against reputation lists and detonate attachments — but a QR code
is pixels. The malicious URL is present in the message yet never enters the URL pipeline,
so a message that would be blocked with the link written out sails through with the link
drawn as a code. The mechanics are covered in
[why QR phishing bypasses email filters](/docs/security/why-qr-phishing-bypasses-email-filters).

**Step two: the victim changes device.** The email says "scan with your phone" — a
completely natural instruction, since you cannot click a printed square. The scan moves
the victim off the corporate laptop, with its endpoint agent, web proxy and URL rewriting,
onto a personal phone with none of those. The mobile browser then truncates the address
bar, hiding exactly the part of a look-alike domain that would give the game away. The
attacker has not broken the desktop's defences; they have walked the victim around them.

## The lures that work

| Lure | Why it lands |
|---|---|
| "Re-enrol your MFA / your authenticator expires today" | MFA setup genuinely uses QR codes, so the request feels routine |
| "Review your payslip / updated salary letter" | Curiosity plus authority; targets payroll-portal credentials |
| "Voicemail waiting" with a QR to "listen" | Mimics unified-comms notifications |
| "Document shared with you" in a PDF attachment | The code hides inside an attachment, one layer further from filters |
| "Your mailbox is full — scan to keep receiving mail" | Urgency aimed at the exact credentials the attacker wants |

The MFA lure is the signature of the genre: because authenticator apps really do enrol by
scanning a QR code, a fake "re-enrolment" is one of the few contexts where scanning a code
from an email seems legitimate. Real MFA enrolment starts from your IT portal or an
in-person process — not from an unexpected email.

## What the destination does

Almost always a credential harvest: a pixel-faithful copy of a Microsoft 365, Google or
single-sign-on page, increasingly run through a reverse proxy that forwards your real
password to the real service and captures the session token — which defeats one-time codes
too, since you type the OTP into the proxy as well. Card-payment clones and
[OAuth consent abuse](/docs/security/can-a-qr-code-steal-your-data) make up most of the
rest.

## Defences

**For individuals**

- Treat a QR code in an email as hostile by default. There are very few legitimate
  reasons for one.
- Decode it without opening it if you need to know what it holds — our [scanner](/scan)
  reads a screenshot of the code in your browser and shows the raw URL, and the
  [domain check](/docs/security/how-to-check-a-qr-code-before-opening) does the rest.
- Never complete MFA changes, payroll access or password entry from a scanned link. Type
  the portal address you know, on the device you normally use.

**For defenders**

- Deploy gateway products that decode QR codes found in message bodies, images and PDF
  attachments — this is now a standard feature in the major mail-security suites, though
  attackers keep probing its edges.
- Add quishing to [security awareness training](/docs/security/qr-codes-in-security-awareness-training)
  and phishing simulations; most programmes still test links and attachments only.
- Tell staff the one sentence that matters: **IT will never send a QR code by email to
  re-enrol MFA.** A single stated policy converts the strongest lure into an alarm.

## FAQ

### Why do phishing emails use QR codes instead of links?
Because filters inspect URLs as text and a QR code is an image, so the link avoids inspection — and because scanning moves the victim from a protected work computer to an unmanaged personal phone with a truncated address bar.

### Is any QR code in an email legitimate?
Rarely. Event tickets and some account-pairing flows use them, but codes demanding MFA re-enrolment, payslip review or password confirmation are near-certain phishing. When unsure, decode the code without opening it and read the domain.

### What is the MFA QR code email scam?
An email claims your authenticator or MFA enrolment expires and shows a QR code to "re-enrol". The code leads to a fake login that captures your password and often the one-time code too. Genuine MFA changes start from your IT portal, not an emailed code.

### Do email security filters catch QR phishing now?
Increasingly — modern gateways decode codes in images and PDF attachments and check the extracted URL. Coverage is uneven across products and attackers adapt, so user-side habits remain the reliable layer.

## Try it

- https://useqr.app/scan
- https://useqr.app/validate