The message says your multi-factor enrolment expires on Friday and that IT needs everyone to re-register. There is no link to hover over and no attachment to open, just a black-and-white square and a line asking you to point your phone at it. Every automated defence that reads text has already read it, found no URL to check, and delivered it.
That is the whole trick behind QR-code phishing, or quishing: a delivery method that moves the dangerous part of a message out of the text layer, where filters work, and into an image, where they do not.
Why a filter that reads text sees nothing to check
A mail gateway works on strings. It pulls URLs out of the body, checks domains against reputation data, often rewrites them so a click can be re-examined later, and opens attachments in a sandbox. All of that assumes the destination exists as characters somewhere in the message. In a QR code it exists only as an arrangement of pixels, and it does not become a URL until a camera decodes it, on a device several metres away from any of the company's defences.
What still survives as text is the envelope: the sending address, the reply-to, the domain in the display name. A courier notice sent from a free webmail account, or from a domain that does not even accept mail, tells you what the picture will not. You can test that with the email address checker on 1mail.lt, which queries the domain's mail records without sending anything.
Where these codes are actually turning up
Four patterns account for most of what people report. The first is physical: a sticker pasted over the genuine code on a parking meter, an EV charger or a restaurant table card. The second is the parcel-redelivery notice, by mail or as a card through the door, warning that a package goes back to the depot unless a small fee is paid. The third is an invoice: a PDF that looks like an ordinary supplier document, with a code where the payment link would be, which sails through filters because the PDF contains no malicious URL.
The fourth is the one that catches office workers. A message in the company's name and internal tone announces that multi-factor authentication is being re-enrolled and that you must scan a code with your phone to finish. It arrives on a Monday, it has a deadline, and it asks for exactly the two things an attacker needs. Anything combining urgency, a login and an instruction to move to your phone deserves a pause. The checklist in the guide to spotting a phishing email in twenty seconds applies unchanged, plus one rule: an unexpected QR code is itself a warning sign.
For the physical ones there is a simple test. On a legitimate parking sign or charger the payment code is printed into the sign itself, in the same ink and under the same laminate as the rest of the artwork. A code on a separate sticker, especially with a slightly different white or an edge peeling away, was added by somebody. Peel it back and the real code is often underneath.
Reading a URL on a four-inch screen
Phones are the soft target, and not because their software is weaker. The address bar is short and truncates the middle of a URL, work mail often sits on a personal device with no corporate filtering, and people scan while standing in a car park in the rain. Most camera apps preview the destination before opening it, and that preview is the most useful moment in the whole chain.
Read it in one specific way. Find the first single slash, then read the domain immediately to its left, that is, the last two labels before it. In a preview reading secure-login.microsoft.com.verify-id.net/mfa/enrol the domain is verify-id.net, and everything impressive to the left is a subdomain the attacker chose. The words after the slash are also theirs and mean nothing. Watch for lookalike letters, a hyphenated version of a brand name, and unusual endings on a name you know. If the preview shows a link shortener, you cannot see the destination at all, which is reason enough not to continue on a phone.
A quieter inbox helps more than it sounds. If the only commercial mail you receive is mail you deliberately signed up for, a delivery notice for a parcel you never ordered stands out instantly instead of blending into the pile. Using a temporary inbox from 1mail.lt for one-off registrations and downloads keeps that background noise out of the mailbox you actually read.
Why a correct 2FA code proves nothing
Here is the part that surprises people. The page behind a quishing code often asks for the password and then a live one-time code, and it accepts them. That is not a badly built fake but a relay: the moment you type them, a server on the other side enters the same values into the real site. Your code works because it really is being used, and the login really does succeed, only the session belongs to somebody else. From then on the attacker holds the session cookie and never needs your password again.
So a code being accepted tells you nothing about who received it. What breaks the relay is a credential bound to the domain it was created for: passkeys and hardware security keys refuse to sign for verify-id.net however convincing the page looks, because the check happens between the browser and the key, not in your head. That is the one defence that does not depend on alertness.
Short of that, time-based codes are still much better than nothing, and clearly better than SMS, which adds SIM-swap risk on top of everything else. If you need to generate or test a TOTP code, the browser-based 2FA code generator does it locally in the page.
Choosing between the two factors is worth a few minutes of your time as well; the comparison of authenticator apps versus SMS codes explains why the gap is wider than most people assume.
What to do if you already scanned and typed
Speed matters more than embarrassment, and everything below should be done from a different device, because you cannot trust the phone that just visited the page until you know what happened.
- Change the password on the affected account, then sign out all active sessions from the security settings, which is the step that actually evicts a stolen cookie.
- Check for the changes attackers make to keep access: added recovery addresses or phone numbers, forwarding rules and filters that quietly delete replies, app passwords, and connected apps you do not recognise.
- Tell whoever runs the account, your IT team or the provider's support, and do it early. A reused password needs changing everywhere else too.
When you contact the company, do not use any address printed in the suspicious message. Look it up independently, and if you are unsure whether a support address you found is real, verifying that the mailbox exists before you send anything is a five-second check that costs nothing.
Common questions about QR-code phishing
Can scanning a QR code infect my phone on its own?
Almost never. A QR code holds text, usually a URL, and the harm comes from what you do after the browser opens it: typing credentials, granting a permission, or paying. Treat a scan as the equivalent of clicking a link from a stranger. The risk is in the page that opens, not in the scan.
Is it safe to scan the code on a restaurant table or a parking meter?
Usually yes, provided the code is printed into the sign or menu rather than stuck on top of it. Check the URL preview before opening, and be suspicious if a menu code leads to a login or payment page. For parking, using the operator's own app or the number printed on the sign avoids the question entirely.
My company sent a QR code for MFA enrolment. How do I know it is genuine?
Do not resolve that question inside the message. Open your account security settings by typing the address yourself, or ask IT through a channel you already use. Genuine enrolment can always be started from inside the account, so an email is never the only route in.
