# QR codes in phishing emails

> Phishing emails use QR codes for two reasons. Filters that inspect URLs cannot read a link hidden inside an image, and scanning moves the victim from a protected work computer to an unmanaged personal phone. Treat any emailed QR code (especially MFA or payroll lures), as hostile until decoded.

Source: https://useqr.app/docs/security/qr-codes-in-phishing-emails · Last reviewed 2026-08-21 · UseQR is free forever, no signup.

---

## The two-step evasion

An emailed QR code is not a gimmick. It defeats two layers of defence in one move, which
is why [quishing](/glossary/quishing) campaigns lean so heavily on email.

**Step one: the filter cannot see the link.** Secure email gateways parse text. They
rewrite URLs, check them against reputation lists and detonate attachments, but a QR code
is pixels. The malicious URL is present in the message yet never enters the URL pipeline,
so a message that would be blocked with the link written out sails through with the link
drawn as a code. The mechanics are covered in
[why QR phishing bypasses email filters](/docs/security/why-qr-phishing-bypasses-email-filters).

**Step two: the victim changes device.** The email says "scan with your phone": a
completely natural instruction, since you cannot click a printed square. The scan moves
the victim off the corporate laptop, with its endpoint agent, web proxy and URL rewriting,
onto a personal phone with none of those. The mobile browser then truncates the address
bar, hiding exactly the part of a look-alike domain that would give the game away. The
attacker has not broken the desktop's defences; they have walked the victim around them.

## The lures that work

| Lure | Why it lands |
|---|---|
| "Re-enrol your MFA / your authenticator expires today" | MFA setup genuinely uses QR codes, so the request feels routine |
| "Review your payslip / updated salary letter" | Curiosity plus authority; targets payroll-portal credentials |
| "Voicemail waiting" with a QR to "listen" | Mimics unified-comms notifications |
| "Document shared with you" in a PDF attachment | The code hides inside an attachment, one layer further from filters |
| "Your mailbox is full: scan to keep receiving mail" | Urgency aimed at the exact credentials the attacker wants |

The MFA lure is the signature of the genre: because authenticator apps really do enrol by
scanning a QR code, a fake "re-enrolment" is one of the few contexts where scanning a code
from an email seems legitimate. Real MFA enrolment starts from your IT portal or an
in-person process, not from an unexpected email.

## What the destination does

Almost always a credential harvest: a pixel-faithful copy of a Microsoft 365, Google or
single-sign-on page, increasingly run through a reverse proxy that forwards your real
password to the real service and captures the session token, which defeats one-time codes
too, since you type the OTP into the proxy as well. Card-payment clones and
[OAuth consent abuse](/docs/security/can-a-qr-code-steal-your-data) make up most of the
rest.

## Defences

**For individuals**

- Treat a QR code in an email as hostile by default. There are very few legitimate
  reasons for one.
- Decode it without opening it if you need to know what it holds: our [scanner](/scan)
  reads a screenshot of the code in your browser and shows the raw URL, and the
  [domain check](/docs/security/how-to-check-a-qr-code-before-opening) does the rest.
- Never complete MFA changes, payroll access or password entry from a scanned link. Type
  the portal address you know, on the device you normally use.

**For defenders**

- Deploy gateway products that decode QR codes found in message bodies, images and PDF
  attachments. This is now a standard feature in the major mail-security suites, though
  attackers keep probing its edges.
- Add quishing to [security awareness training](/docs/security/qr-codes-in-security-awareness-training)
  and phishing simulations; most programmes still test links and attachments only.
- Tell staff the one sentence that matters: **IT will never send a QR code by email to
  re-enrol MFA.** A single stated policy converts the strongest lure into an alarm.

## FAQ

### Why do phishing emails use QR codes instead of links?
Because filters inspect URLs as text and a QR code is an image, so the link avoids inspection, and because scanning moves the victim from a protected work computer to an unmanaged personal phone with a truncated address bar.

### Is any QR code in an email legitimate?
Rarely. Event tickets and some account-pairing flows use them, but codes demanding MFA re-enrolment, payslip review or password confirmation are near-certain phishing. When unsure, decode the code without opening it and read the domain.

### What is the MFA QR code email scam?
An email claims your authenticator or MFA enrolment expires and shows a QR code to "re-enrol". The code leads to a fake login that captures your password and often the one-time code too. Genuine MFA changes start from your IT portal, not an emailed code.

### Do email security filters catch QR phishing now?
Increasingly, modern gateways decode codes in images and PDF attachments and check the extracted URL. Coverage is uneven across products and attackers adapt, so user-side habits remain the reliable layer.

## Try it

- https://useqr.app/scan
- https://useqr.app/validate