Quishing: What to Do When Someone Scans a QR Code Phishing Email

What should I do if someone scanned a QR code in an email?

If they only scanned it and closed the page, have them report the email and delete it. If they typed a password, approved an MFA prompt, or downloaded anything, treat the account as compromised and call IT now. Do these in order:

1. Don’t sign in again from that phone. Leave it alone and set it aside for IT.
2. Call IT or your MSP. Say “someone entered their password on a phishing page from a QR code.” That sentence gets the right response.
3. Revoke every session on the account. In Microsoft 365, an admin opens the user in the Entra admin center and selects Revoke sessions. Microsoft’s emergency access revocation guide covers it. Have IT do this.
4. Reset the password from a clean computer, not the phone that scanned the code.
5. Check the mailbox. IT should look for new inbox rules, forwarding, MFA methods the user didn’t add, and sent mail the user didn’t send.
6. Warn anyone with money in motion. If the user handles wires or closings, call the other parties at numbers you already had. Don’t email them. Our wire verification guide walks through that call.
7. Don’t delete the email. IT needs it to find everyone else who got it.

If money already moved, call your bank first, then file at ic3.gov. Our incident response plan template has the call list to keep ready.

What is quishing?

Quishing is phishing with a QR code instead of a clickable link. The FBI’s January 8, 2026 FLASH alert defines it as embedding malicious URLs inside QR codes “to force victims to pivot from their corporate endpoint to a mobile device, bypassing traditional email security controls.” The code usually arrives as an image in the email or inside an attached PDF.

It’s growing fast. Microsoft Threat Intelligence reported QR code phishing volume went from 7.6 million attacks in January 2026 to 18.7 million in March, a 146% increase over the quarter.

The FTC has been warning about this since its December 2023 consumer alert: don’t scan a QR code in an email or text you weren’t expecting, especially if it pushes you to act right away.

Why do QR codes get past email security?

A QR code is a picture, not a link. Email filters are built to read, rewrite, and test links before anyone clicks them. The FBI alert says QR images “evading URL inspection, rewriting, and sandboxing.” Then the scan happens on a phone, which is the real problem.

The work laptop has your EDR, your web filtering, and your monitoring. The personal phone usually has none of that. The FBI puts it plainly: “the compromise path originates on unmanaged mobile devices outside normal Endpoint Detection and Response (EDR) and network inspection boundaries.” The attacker picked the one device you can’t see.

The pages are built for phones, too. The FBI describes redirectors that check the device type, operating system, and screen size, then serve a mobile login page made to look like Microsoft 365, Okta, or a VPN portal. On a small screen, the address bar is easy to miss.

Does MFA stop QR code phishing?

Not the usual kind. Codes and push prompts can be relayed by a proxy page that sits between the user and the real login. The user types their password and approves their prompt like normal. The attacker keeps the session token that comes back. The FBI says quishing “frequently end[s] with session token theft and replay,” which bypasses MFA “without triggering typical ‘MFA failed’ alerts.”

That’s why a password reset alone doesn’t close it. The stolen token is the attacker’s key, and they don’t need the password while it’s valid. Revoking sessions forces every device, including theirs, to sign in again. Microsoft notes that access tokens it issues last one hour by default, so expect a short tail after revocation.

What does stop it is phishing-resistant MFA: passkeys, FIDO2 security keys, or smart cards. Those check which site they’re talking to before they answer, so a fake page gets nothing it can replay. The FBI’s recommendations include it: “Require phishing-resistant MFA for all remote access and sensitive systems.”

How do you spot a QR code phishing email?

The tell is a QR code in an email at all. Real business email rarely needs one. You’re already at a computer, so a sender who wants you on your phone is a red flag. Watch for:

• “Scan to review” or “scan to sign.” A document, invoice, or closing package you have to scan to open. The FBI’s examples include a QR code that “purported to provide access to a secure drive.”
• “Scan to keep your account active.” Fake MFA re-enrollment, password expiry, or mailbox storage notices.
• A PDF attachment with almost no text besides a QR code and a deadline.
• Urgency. The FTC calls out scammers who say there’s a problem with your account or suspicious activity “to create a sense of urgency.”
• A login page on your phone right after you scanned a code from your work email.

If the message might be real, go to the site the way you normally would, or call the sender at a number you already had. That’s the FBI’s advice too: verify through “secondary means.”

Why are title companies a target?

Title companies run on e-signature requests and wire instructions, so a “document ready to sign” lure looks like Tuesday. A closer who scans one on their phone hands over the mailbox where wire instructions live. From there it’s business email compromise. The FBI notes attackers use the compromised mailbox to send more phishing to everyone it talks to.

Our managed IT for title companies page covers the wire fraud side. If your closers get e-signature requests all day, also read our guide to fake DocuSign emails.

What controls stop quishing next time?

No single setting stops it. You stack a few so one mistake doesn’t become a breach:

• Phishing-resistant MFA for anyone who moves money or has admin rights first, then everyone.
• Only managed devices can sign in. In Microsoft 365, a Conditional Access policy can require a compliant device, so a password and token phished onto someone else’s phone don’t open the mailbox.
• Mail filtering that reads images and attachments. Microsoft recommends turning on Safe Links and Safe Attachments in Defender for Office 365.
• Monitoring on sign-ins and mailboxes, so new inbox rules, new MFA methods, and odd sign-in locations raise an alert.
• Training with one rule: never scan a QR code from an email. Report it instead.

If a scan also downloaded something to a computer, our infostealer malware guide covers what that malware takes and why it’s a bigger cleanup.

Key takeaways

What this looks like when we do it

On our managed IT and security baseline, MFA is enforced across the tenant, not left optional per user. We push the people who handle money and admin rights toward phishing-resistant methods, and we set up Microsoft 365 email hardening and endpoint detection and response on the computers we manage.

We also watch the things a quished account leaves behind: new inbox rules, new MFA methods, and sign-ins that don’t fit. When someone calls to say they scanned a code and typed their password, we revoke the sessions, reset from a clean device, and walk the mailbox before the attacker uses it. Critical calls get a response in under 15 minutes.

If you want to know whether a stolen password and token would open your mailbox today, our managed IT security page is the place to start, or book a call and we’ll look at it with you.