Why QR phishing bypasses email filters

Secure email gateways were built to parse text. They rewrite URLs, check link reputation and sandbox attachments. A QR code is pixels, not text, so the malicious URL never enters those pipelines. Gateways increasingly decode images in response, but coverage is uneven, so the user-side domain check still matters.

What an email filter actually inspects

A secure email gateway (SEG) runs a message through a pipeline built around one assumption: dangerous content is addressable as text or as a file. Typically:

Sender checks: SPF, DKIM, DMARC, sending-IP reputation.
URL extraction, every link in the HTML body is parsed out.
Reputation lookup: each URL is compared against block lists and domain-age data.
URL rewriting: links are wrapped (Microsoft Safe Links, Proofpoint URL Defense and similar) so they can be re-checked at click time.
Attachment analysis: files are detonated in a sandbox and watched for behaviour.

Every stage keys off the same thing: a string that parses as a URL, or a file that executes. That assumption held for two decades of phishing.

What a QR code is to that pipeline

An image. The malicious URL is present in the message (encoded as a grid of modules in a PNG), but stage 2 finds no string to extract, so stages 3 and 4 never run. Nothing executes, so the sandbox in stage 5 sees a static picture and passes it. A message whose written-out link would be rewritten, reputation-checked and probably blocked is delivered untouched when the same link is drawn as a code. That structural gap, plus the shift of the victim onto an unmanaged phone, is the whole story of QR codes in phishing emails.

It helps the attacker further that the code arrives in trusted clothing. Since a QR render is deterministic, the attacker can style it like any legitimate MFA enrolment graphic, embed it in a pixel-perfect corporate template, and there is no anchor text, no href, and no mismatch between displayed and actual link for a filter (or a hover), to catch.

The arms race

Vendors responded, and the gap is narrowing rather than closed:

Defender move	Attacker counter
Decode QR codes found in message-body images	Move the code into a PDF or Office attachment, one parser further away
Decode codes inside attachments	Split the code across image slices the client reassembles, or build it from HTML table cells rather than an image
Check the decoded URL's reputation	Use a fresh domain, a link shortener chain, or an open redirect on a legitimate domain
Follow the decoded link in a sandbox	Serve the phishing page only to mobile user agents, or gate it behind a CAPTCHA the sandbox will not solve
Flag "scan with your phone" phrasing	Put the instruction inside the image too

Each defender row is real and shipping in the major mail-security products; each attacker counter has been observed in the wild. This is why "our gateway decodes QR codes" is necessary but not sufficient.

What actually holds

The one layer the arms race cannot route around is the reader of the final URL. Whatever survives to the phone must still show its destination on the preview banner, and a user who reads the domain (the part immediately before the first single slash) beats every variant above. The checking routine is the same as ever, and decoding a suspicious code from a screenshot with a client-side scanner inspects it with zero risk of opening. For organisations, pairing gateway decoding with awareness training that actually includes QR lures (and a stated policy that IT never emails QR codes) covers both ends.

FAQ

Why do email filters miss QR codes?

Filters extract and check URLs as text strings. A QR code stores the URL as an image of black and white modules, so URL extraction finds nothing, reputation checks never run, and link rewriting has nothing to wrap.

Do any email security products decode QR codes now?

Yes, decoding codes in message bodies and common attachment types is now a standard capability in the major gateways. Attackers respond with attachments-within-attachments, split images, mobile-only pages and redirect chains, so detection rates vary.

What is URL rewriting and why does a QR code defeat it?

Gateways wrap each link in a tracking URL so it can be re-checked when clicked. A QR code contains no clickable link to wrap: the "click" happens on the user's phone camera, entirely outside the email system.

What should an organisation do about QR phishing?

Enable QR decoding at the gateway, include QR lures in phishing simulations, and publish one clear rule: IT will never send a QR code by email for MFA or password tasks. The combination addresses the filter gap and the human gap together.