Quishing
QR code phishing, and why text filters miss it
A QR code moves the payload out of the text a filter reads and into an image — then out of the mailbox entirely, onto a phone that has none of your protection in front of it.
Included on every protected domain, at no extra cost, with the decoded destination recorded whether or not it scored.
Why it works on almost everything else
Every other stage of a mail filter inspects text: the body, the headers, the links, the attachment names. A QR code is specifically a way of not being text. The message contains a picture and a sentence like "scan to confirm your delivery", and there is no URL in it for a link scanner to check.
Then the victim uses their phone. The company's mail filter, its DNS filtering and its endpoint protection are all on the laptop the message arrived on, and none of them are on the device that visits the site.
What the gateway actually does
It reads the code. Images in the body, images attached, QR codes on the first pages of a PDF, and codes embedded in Office documents are decoded, and the destination is assessed the way any other link would be.
A QR code is not itself a threat
Newsletters, invoices, event tickets and restaurant menus contain them legitimately. Scoring their mere presence would punish ordinary mail, so presence alone scores nothing. What scores is where the code goes:
- A URL shortener hiding the real destination.
- A bare IP address instead of a name.
- A path that looks like a sign-in or verification page.
- A brand named in the message text with a destination that has nothing to do with it — the whole quishing pattern in one check.
- An unencrypted destination, or one that other stages already know is bad.
- A non-web payload: a WiFi credential, a payment string, a phone number.
What was in the code is always recorded
Even when it scores zero. An administrator asked "what was in that QR code" cannot be answered by a score, and the entire point of putting a payload in an image is that nobody can see it. Message tracking shows the decoded destination for every code the gateway read.
That matters more than the scoring does. Most QR codes in business mail are legitimate; the value of reading them is that when one is not, somebody can see exactly what it was pointing at without scanning it themselves.
Monitor first, enforce when you have seen it
New detection turned straight to blocking is how a filter loses a customer's trust in its first week. QR detection starts in Monitor Mode on a domain: every code is read, every destination is recorded, and the score is shown separately without affecting whether the message is delivered.
When you have looked at a few weeks of your own mail and can see what would have been held, you turn enforcement on for that domain. It is a per-domain switch, not a platform-wide one, so a customer with a QR-heavy newsletter operation is not forced into the same posture as one without.
Reading a QR code runs on the delivery path, so it is bounded: attachments over a size cap are skipped, only the first pages of a PDF are rendered, and the number of images examined per message is limited. A message whose codes cannot be read is still delivered and still scanned by everything else. Mail delivery outranks any single stage.