SecNews24.com
QR Code Phishing Exploits Gaps Between Email And Mobile Security
A new phishing technique is using QR codes to move malicious links out of the email message and onto a victim’s phone. The approach, often called quishing, places a QR image inside an email, PDF, invoice, poster or collaboration message. When scanned, it can open a counterfeit login page, payment form or malware distribution site.
Traditional email security systems are designed to inspect text, hyperlinks, attachments and sender behaviour. An image containing a QR code may provide little visible information for those controls to analyse. The destination is revealed only after a camera application decodes the image, creating a gap between inbox protection and mobile browsing security.
The method is particularly relevant in Australia, where QR codes are common in cafés, retail stores, event venues and public transport campaigns. A message that appears to relate to Australia Post delivery tracking, myGov access, Medicare information or a bank payment can look familiar enough to prompt a quick scan.
Security teams and consumers should treat a QR code as a concealed hyperlink rather than as a harmless graphic. The code itself may be technically legitimate while the website behind it collects passwords, payment details, authentication codes or personal information.
How QR Phishing Avoids Conventional Filters
Email gateways commonly score messages by examining domain reputation, URL structure, wording, sender history and attachment content. A written link to a newly registered phishing domain can be blocked before delivery. A QR image, however, can conceal the same destination from systems that do not decode image content or follow the resulting redirect.
Attackers can also embed the code in a password-protected PDF, a screenshot or an image-heavy newsletter. Some campaigns use HTML formatting to make the message appear like a security alert, parcel notification or account verification request. The recipient is told to scan the image with a phone because the action supposedly improves security or is required for mobile authentication.
Once scanned, the victim leaves the protected desktop environment. The phone may have different DNS controls, browser policies, endpoint detection and multifactor authentication settings. A user who reads mail on a corporate laptop but scans with a personal handset has effectively transferred the risky interaction to another device and network.
The final destination can use several redirects, geolocation checks and device fingerprinting. A security researcher may see an inactive page, while a targeted recipient receives a convincing Microsoft 365, Google Workspace, banking or parcel-delivery imitation.
The Attack Path From Image To Account Theft
A typical campaign begins with a trusted-looking message. It may reference an unpaid invoice, a document shared through cloud storage, an expiring account or a failed delivery. The QR code directs the recipient to a landing page that copies the branding and layout of a familiar service.
The fake page may request an email address and password before asking for a one-time code. More advanced campaigns use adversary-in-the-middle infrastructure to relay credentials and session tokens to the attacker in real time. This can allow account access even when the victim has enabled multifactor authentication.
QR phishing is also useful for payment fraud. A code displayed on a restaurant table, parking meter, community noticeboard or event sign can be replaced with one leading to a criminal-controlled payment page. In Australia, where mobile banking and contactless payments are routine, a small visual change can go unnoticed in a busy setting.
The technique can support malware delivery as well. A QR code may lead to a fake Android application, a browser notification prompt or a page claiming that a security update is required. A separate example of how criminals exploit trust around security software can be found in this activation site example, which illustrates why users should verify domains rather than rely on familiar-looking branding.
Why Mobile Devices Change The Risk
A QR scan creates a physical and psychological break from the original message. The victim may no longer see the sender address, email warning banner or suspicious attachment. Instead, the phone presents a compact browser view where a shortened URL, redirect chain or lookalike domain is harder to evaluate.
Mobile browsers can also hide the full address bar, while small screens make spelling differences difficult to notice. A counterfeit domain using extra words, alternate characters or a misleading subdomain may appear authentic at a glance. Attackers can additionally use mobile-specific pages that do not load when investigators visit from a desktop computer.
Australian workplaces often combine corporate identity systems with personal devices. Staff working from home in Brisbane, Perth or Adelaide may read an email on a managed computer and scan from a privately owned phone. Bring-your-own-device policies, contractor access and cloud applications expand the number of paths that security teams need to monitor.
The risk extends beyond employees. Customers may scan codes on utility notices, real estate signs, sporting club communications or printed correspondence. Local organisations that use QR codes for registrations, donations and payments need a process for protecting the code-generation workflow and checking physical signs after installation.
| Attack stage | What the victim sees | Security gap | Useful control |
|---|---|---|---|
| Delivery | A routine email, PDF or poster | Image content may receive limited inspection | Decode and analyse QR images at the gateway |
| Scan | A camera prompt or browser notification | The interaction moves to a separate device | Apply mobile web filtering and DNS protection |
| Redirect | A short or unfamiliar web address | The final domain may be hidden | Expand redirects and inspect destination reputation |
| Login | A copied sign-in page | Credentials and session data can be captured | Use phishing-resistant authentication and password managers |
| Payment | A branded checkout screen | Payment context may seem routine | Confirm payee details through a separate trusted channel |
| Follow-up | A request for a code or app install | Social engineering continues after the scan | Train users to report and isolate suspicious activity |
Warning Signs In A QR Message
A QR code is not proof that a message is fraudulent. The surrounding request, timing and destination matter more than the graphic itself. Recipients should pause when a message creates urgency, threatens account closure or claims that scanning is safer than clicking a normal link.
Warning signs often appear in combinations:
- An unexpected request to scan a code to unlock, verify or restore an account
- A sender address that differs subtly from the organisation’s known domain
- A QR image embedded in a document that was not requested
- A payment request that changes bank details or bypasses an established process
- A landing page asking for a password, authentication code or app installation
People should preview the destination when the scanning application permits it and compare the domain with the organisation’s official website. A message about Australia Post, a bank or a government service should be checked through an independently opened application or bookmarked site, rather than through the QR code.
A password manager can provide an additional warning because it generally will not autofill credentials on an unfamiliar domain. Users should never provide a one-time authentication code to a page reached through an unexpected message. Suspicious communications can be reported through the relevant organisation and to Scamwatch, while compromised accounts require immediate password resets and session revocation.
Defensive Controls For Security Teams
Organisations should treat QR decoding as part of email and web inspection, rather than as an optional image feature. Secure email gateways can extract QR codes from images and documents, resolve the encoded URL in a sandbox, follow redirects and apply reputation, malware and impersonation checks.
Mobile protection matters just as much. DNS filtering, browser isolation, mobile threat defence and conditional access policies can prevent a handset from reaching known malicious infrastructure. Security teams should review whether personal devices accessing corporate accounts receive the same web protection as managed endpoints.
Identity controls reduce the value of stolen passwords. Passkeys and hardware-backed security keys are more resistant to fake login pages than passwords combined with codes that users manually enter. Risk-based access policies can also challenge unfamiliar devices, impossible travel patterns and sign-ins from suspicious hosting networks.
Incident response plans should include QR-specific evidence. Investigators may need the original email, image hash, decoded URL, redirect sequence, browser history, device details and authentication logs. Fast collection is important because attackers frequently rotate landing pages and infrastructure after a campaign is reported.
Practical controls can be grouped by the teams responsible for them:
- Email administrators should enable image and document QR extraction, URL detonation and sender authentication checks
- Identity teams should deploy passkeys where possible and restrict risky authentication flows
- Endpoint teams should enforce mobile browser, DNS and application-installation policies
- Finance teams should verify payment changes using known contact details
- Security awareness teams should include printed-code and mobile-device scenarios in exercises
Australian businesses should also align detection and reporting with the Australian Cyber Security Centre’s guidance and their existing privacy obligations. If personal information is exposed, incident managers may need to assess whether the event triggers notification duties under the Notifiable Data Breaches scheme and coordinate with legal, privacy and communications teams.
Detection And Response After A Scan
A scan does not automatically mean an account has been compromised. The outcome depends on what happened next. Opening a page is different from entering credentials, downloading an application, approving a push notification or transferring money. Response teams should establish that sequence without blaming the person who reported it.
If credentials were entered, the affected password should be changed from a known-clean device, active sessions should be revoked and multifactor methods should be reviewed. If a work account was involved, administrators should examine mailbox rules, forwarding settings, OAuth grants, recent sign-ins and unusual file access.
Where a payment was made, the bank should be contacted immediately through its official number. A phone that installed an untrusted application may need network isolation, evidence preservation and professional examination. Deleting the app alone may remove useful forensic data without addressing persistence or stolen tokens.
Organisations can improve future detection by examining similar messages across the environment. Search for matching image hashes, subject lines, sender infrastructure, decoded domains and redirect patterns. Historical security reporting, including the cybersecurity archive, can also help teams compare how social-engineering methods evolve across campaigns.
Building A Safer QR Code Culture
The most effective response is a change in assumptions: QR codes should be handled as links, and links should be assessed according to context. A code printed on a trusted venue’s sign may still have been replaced. A code inside a professionally formatted email may still lead to credential theft.
Businesses that publish QR codes should record where each code is used, keep ownership of the destination domain and inspect physical materials regularly. They should avoid directing users through unnecessary redirects and make the final domain easy to verify. Payment codes deserve a separate approval process because compromise can create direct financial losses.
Public-facing organisations should make safe alternatives available. A notice can display a short official web address, a customer service number and clear instructions for checking the destination. Staff in retail, hospitality and community settings should know how to report a replaced or suspicious code quickly.
The same discipline applies to cybersecurity teams. QR analysis should be included in email telemetry, mobile threat monitoring, awareness exercises and incident playbooks. Research into adjacent threats, such as weaknesses that allow security tools to be bypassed, is covered in this ransomware decryptor report, reinforcing the need to test assumptions rather than rely on a single protective layer.
QR phishing succeeds when security controls stop at the inbox and users assume that scanning is a neutral action. Closing the gap requires image-aware filtering, protected mobile browsing, strong identity systems, verified payment procedures and rapid reporting. In an environment where QR codes are embedded in everyday Australian commerce and public services, treating them as concealed web links is a basic security control.