What Makes Email Quishing Different
A QR code sitting in your inbox doesn't look like a phishing link. It looks like a routine notification, or a document you're meant to open. That's the point. Quishing has been climbing for a while as a broader trend, but the email version specifically targets the gap between what your filters check and what a QR code hides. This isn't the sticker-over-a-parking-meter scam — it's a code baked directly into a message that lands in your inbox looking clean, because to a spam filter, it often is.
The Numbers Behind the Surge
Email quishing didn't creep up gradually. It spiked. Microsoft's Q1 2026 threat data shows quishing volume rising from 7.6 million detections in January to 18.7 million in March — a 146% increase over the quarter, after an initial dip in January.
Most of that volume still travels inside PDF attachments: 65% of cases in January, climbing to 70% by March. But QR codes embedded directly in the email body surged 336% in March alone. Still a small slice of total volume, around 5%, but it points to attackers testing new placements as filters catch up on attachments.
Why Filters Miss It
Secure email gateways, sandboxes, and link-protection tools are built to inspect what they can read: visible URLs, checked against blacklists and reputation scores. A QR code hides that same destination inside an image instead, and most inspection layers simply don't evaluate what's inside the image before the message reaches your inbox.
There's a second gap working in the attacker's favor: where you open the link. Reading email on a work laptop usually means some endpoint protection is watching. Scanning a QR code moves that click to your phone's camera app instead, which redirects straight to the destination in your phone's browser — a device that, for most people, has none of the same monitoring.
Why This Works Even With MFA Enabled
The scarier campaigns don't try to steal your password at all. FBI advisories on state-linked phishing groups describe QR codes routing victims to convincing fake login pages, then capturing the session token created right after a real, successful login — MFA included. That token can be replayed to hijack the account without ever triggering an "MFA failed" alert, because nothing did.
It's a similar mechanism to how QR code login hijacking works elsewhere: the danger isn't guessing your password. It's intercepting what happens after you've already proven who you are.
How to Protect Your Inbox
Treat an unexpected QR code in an email exactly like an unexpected link: don't scan it on reflex. If the message claims to be from a service you use, go to that service directly through your browser or app instead of following the code.
When you scan codes day to day, use your phone's built-in camera or scanner rather than a random third-party app. Some general rules for scanning any QR code safely apply here too, and picking a QR scanner that doesn't just auto-open links gives you a beat to check the destination before your browser loads it.
Frequently Asked Questions
Can a QR code in an email actually be dangerous?
Yes. A QR code just hides a URL inside an image, and email filters mostly inspect text-based links — not what's encoded in a picture. If that hidden destination is a fake login page, scanning it can expose your credentials the same way clicking a malicious link would.
Why don't spam filters catch these QR codes?
Filters check visible URLs against blacklists and reputation scores. A QR code encodes that same URL as an image, which sits outside what those text-scanning engines evaluate.
Does scanning a QR code bypass two-factor authentication?
It can. Some campaigns route you to a real-looking login page and steal the session token created right after you authenticate, MFA included — that stolen token can be reused without ever tripping an "MFA failed" alert.
What should I do if I get an unexpected QR code by email?
Treat it like an unexpected link: don't scan it. Verify the sender separately, and if you need to act, go to the service directly through your browser or app instead.
Conclusion
The danger in email quishing was never really about QR codes themselves. It's that they hide a destination from both your filters and your instincts at the same time. As inbox security tools catch up and start scanning embedded images, expect the delivery method to keep shifting again, the way it already moved from attachments toward inline codes this year. Staying skeptical of any unsolicited code, no matter how official the message looks, is the one defense that doesn't depend on which format attackers try next.