Quishing: the QR-code phishing surge of 2024-2025

Quishing (QR-code phishing) emerged as a distinct category in late 2022 and grew rapidly through 2023-2025. The category is structurally different from URL-based phishing in two ways that matter for defender economics. First, the payload is an image, which means the standard email-gateway URL-rewriting and reputation-lookup defences do not see the malicious URL until the victim has decoded the QR code with their phone camera. Second, the decode-and-visit step happens on the victim's mobile device, which is frequently outside the corporate network perimeter, without the EDR endpoint agent that would otherwise log or block the visit.

The combined effect is that quishing converts at a materially higher rate than URL phishing against the same target population. Independent measurements from Keepnet and Microsoft Threat Intelligence place quishing click-through at approximately 30 to 45 percent against a 12 to 18 percent baseline for URL phishing. The defender loses visibility at the moment of the scan because the subsequent attacker-controlled page is loaded by the victim's personal browser, frequently on a personal phone, with no corporate-issued certificate or monitoring agent in the path.[Keepnet 2025 + Microsoft Threat Intelligence 2024]

Four lure patterns dominate the 2024-2026 quishing landscape. Each has distinct defender implications.

Through late 2023 and into 2024, attackers placed counterfeit QR-code stickers over the legitimate payment QR codes on parking meters in multiple US cities. The pattern began in Austin and San Antonio, then spread to Houston, Atlanta, Denver, and several other major US metropolitan areas. The Austin Police Department issued a public warning in December 2023 after dozens of consumer complaints; the City of San Antonio followed in January 2024. The pattern then spread internationally with similar cases reported in the UK and continental Europe.

The economic damage was material. Individual victim losses ran from approximately $40 (the typical parking-payment charge plus an immediate small follow-up charge) to several thousand dollars when the card was subsequently used for high-value purchases on the underground market. Aggregate consumer loss across the US wave is estimated at low-millions of dollars. The damage to the impersonated municipal-parking brand was harder to quantify but real: trust in QR-enabled municipal payment systems dropped measurably in consumer survey data through 2024.

The defender lesson is that physical-world QR overlays are an attack class that defenders cannot rely on technical controls to stop. The mitigation is procedural: municipalities and other public-infrastructure operators have moved to QR codes that include a visible verification token (a printed code that must match a code shown on the legitimate payment page) and to QR-code sealing techniques (tamper-evident overlays that show physical evidence of replacement). Adoption is uneven; most US cities still have unprotected QR codes on parking infrastructure as of mid-2026.[Austin PD bulletin Dec 2023 + San Antonio public notice Jan 2024 + Better Business Bureau alerts 2024]

The pivot-containment line is structurally smaller than for spear-phishing because the typical quishing payload lands on a personal mobile device with limited corporate-system reach. The customer-trust restoration line is unusual to this vector because impersonated brands carry burden even when no direct customer was harmed.[IBM 2025 + Keepnet 2025 quishing-vector breakdown]

The quishing control stack has two distinct layers: pre-scan (catching the QR-as-image at the email gateway) and post-scan (catching the destination URL on the mobile device). Both are necessary; neither is sufficient.

The structural reason quishing converts at higher rates than URL phishing is that the scan-action moves the victim across a device boundary that defenders have historically struggled to instrument. The corporate computer that received the email has EDR, browser-filtering, network monitoring, certificate-pinning, and full DLP coverage; the personal mobile that scans the QR has, in most enterprises, none of these. The defender's visibility into the post-scan attacker page is approximately zero unless the organisation has deployed MDM with browser-filtering on personal devices, which most have not.

The defender response has to acknowledge the device-shift rather than fight it. Two pragmatic responses dominate: first, accept that the post-scan visibility is lost and invest in pre-scan controls (image-OCR at the gateway) and post-credential controls (phishing-resistant MFA at the destination); second, deploy MDM with browser-filtering on the personal devices that access corporate resources, accepting the user-experience cost and the privacy negotiation that this implies. The second response is more expensive but covers a broader attack surface; the first is cheaper but accepts more residual risk.

The middle path that some organisations have settled on is mandatory FIDO2 MFA on the corporate resources most likely to be quishing targets (M365, SSO portal, payroll, corporate banking) without requiring full MDM on personal devices. This closes the highest-value attack chains while preserving personal-device autonomy. It accepts that low-value credential harvesting will still succeed but limits the downstream pivot value to near zero. The cost-per-dollar-of-loss-prevented is favourable.[Microsoft Threat Intelligence Quishing Report 2024 + Keepnet 2025]

• All phishing attack vectors
• Smishing cost
• AitM phishing cost
• MFA fatigue cost
• Proofpoint TAP cost (image-OCR coverage)
• Abnormal Security cost
• KnowBe4 cost (quishing modules)
• Hoxhunt cost
• databreachcost.com
• mdrcost.com