# Why QR phishing bypasses email filters

> Secure email gateways were built to parse text. They rewrite URLs, check link reputation and sandbox attachments. A QR code is pixels, not text, so the malicious URL never enters those pipelines. Gateways increasingly decode images in response, but coverage is uneven, so the user-side domain check still matters.

Source: https://useqr.app/docs/security/why-qr-phishing-bypasses-email-filters · Last reviewed 2026-08-21 · UseQR is free forever, no signup.

---

## What an email filter actually inspects

A secure email gateway (SEG) runs a message through a pipeline built around one
assumption: dangerous content is addressable as text or as a file. Typically:

1. **Sender checks**: SPF, DKIM, DMARC, sending-IP reputation.
2. **URL extraction**, every link in the HTML body is parsed out.
3. **Reputation lookup**: each URL is compared against block lists and domain-age data.
4. **URL rewriting**: links are wrapped (Microsoft Safe Links, Proofpoint URL Defense
   and similar) so they can be re-checked at click time.
5. **Attachment analysis**: files are detonated in a sandbox and watched for behaviour.

Every stage keys off the same thing: a string that parses as a URL, or a file that
executes. That assumption held for two decades of phishing.

## What a QR code is to that pipeline

An image. The malicious URL is present in the message (encoded as a grid of modules in a
PNG), but stage 2 finds no string to extract, so stages 3 and 4 never run. Nothing
executes, so the sandbox in stage 5 sees a static picture and passes it. A message whose
written-out link would be rewritten, reputation-checked and probably blocked is delivered
untouched when the same link is drawn as a code. That structural gap, plus the shift of
the victim onto an unmanaged phone, is the whole story of
[QR codes in phishing emails](/docs/security/qr-codes-in-phishing-emails).

It helps the attacker further that the code arrives in trusted clothing. Since a QR
render is deterministic, the attacker can style it like any legitimate MFA enrolment
graphic, embed it in a pixel-perfect corporate template, and there is no anchor text, no
`href`, and no mismatch between displayed and actual link for a filter (or a hover), to
catch.

## The arms race

Vendors responded, and the gap is narrowing rather than closed:

| Defender move | Attacker counter |
|---|---|
| Decode QR codes found in message-body images | Move the code into a PDF or Office attachment, one parser further away |
| Decode codes inside attachments | Split the code across image slices the client reassembles, or build it from HTML table cells rather than an image |
| Check the decoded URL's reputation | Use a fresh domain, a [link shortener](/glossary/short-url) chain, or an open redirect on a legitimate domain |
| Follow the decoded link in a sandbox | Serve the phishing page only to mobile user agents, or gate it behind a CAPTCHA the sandbox will not solve |
| Flag "scan with your phone" phrasing | Put the instruction inside the image too |

Each defender row is real and shipping in the major mail-security products; each attacker
counter has been observed in the wild. This is why "our gateway decodes QR codes" is
necessary but not sufficient.

## What actually holds

The one layer the arms race cannot route around is the reader of the final URL. Whatever
survives to the phone must still show its destination on the preview banner, and a user
who reads the domain (the part immediately before the first single slash) beats every
variant above. The
[checking routine](/docs/security/how-to-check-a-qr-code-before-opening) is the same as
ever, and decoding a suspicious code from a screenshot with a client-side
[scanner](/scan) inspects it with zero risk of opening. For organisations, pairing
gateway decoding with [awareness training](/docs/security/qr-codes-in-security-awareness-training)
that actually includes QR lures (and a stated policy that IT never emails QR codes)
covers both ends.

## FAQ

### Why do email filters miss QR codes?
Filters extract and check URLs as text strings. A QR code stores the URL as an image of black and white modules, so URL extraction finds nothing, reputation checks never run, and link rewriting has nothing to wrap.

### Do any email security products decode QR codes now?
Yes, decoding codes in message bodies and common attachment types is now a standard capability in the major gateways. Attackers respond with attachments-within-attachments, split images, mobile-only pages and redirect chains, so detection rates vary.

### What is URL rewriting and why does a QR code defeat it?
Gateways wrap each link in a tracking URL so it can be re-checked when clicked. A QR code contains no clickable link to wrap: the "click" happens on the user's phone camera, entirely outside the email system.

### What should an organisation do about QR phishing?
Enable QR decoding at the gateway, include QR lures in phishing simulations, and publish one clear rule: IT will never send a QR code by email for MFA or password tasks. The combination addresses the filter gap and the human gap together.

## Try it

- https://useqr.app/scan
- https://useqr.app/validate