In this guide · 7 sections
Short answer
Quishing hides a phishing link in a QR code. Never scan QR codes in unexpected emails or messages, especially ones asking you to log in. Check the website address after scanning and the payee name before paying. If you display QR codes, check them for stickers or tampering every day.
What is QR code phishing (quishing)?
The CSA and SPF joint advisory on malicious QR codes (22 May 2023) says QR codes aren't dangerous in themselves, but attackers use them to trick people into exposing themselves. It lists four common attacks.
| Attack | What happens | Business example |
|---|---|---|
| Phishing | The code opens a fake site that asks for logins, card numbers or personal data | An email QR code leads to a fake Microsoft 365 sign-in page |
| QR code swap | A real code at a business is altered or covered so payments go to the attacker | A sticker over your PayNow QR at the counter |
| Malware | The code leads to a download that installs malware on the phone | A 'survey for a free drink' sticker on your shop door |
| Fake ads in scanner apps | Third-party scanner apps show ads that lead to phishing sites | Staff using a random scanner app instead of the phone camera |
The malware route has cost real money in Singapore. In 2023 The Straits Times reported a customer who scanned a 'survey' QR sticker on a bubble tea shop's door, installed an app, and lost S$20,000 when scammers took over her phone.
Why QR codes in emails get past your defences
Most phishing training tells staff to hover over a link and check the address. A QR code has no link to hover over, and the address only appears on the phone that scans it. Several things make email quishing effective:
- Filters see an image, not a link. Email security that checks links may not decode a QR code inside an image or PDF attachment.
- The attack moves to a phone. The scan happens on a personal mobile, usually outside your company's web filtering and endpoint protection.
- Small screens hide the details. A fake login page on a phone shows less of the address, so look-alike domains are harder to spot.
- The story sounds routine. 'Scan to re-enable MFA', 'scan to view your payslip' or 'scan to sign this document' fit everyday work.
Our phishing email guide covers the other signs; quishing emails usually share them: urgency, a sender address that doesn't match, and a request to sign in.
Safe scanning habits for staff and customers
These habits come straight from the CSA and SPF advisory, rewritten for a workplace.
Don't scan codes from unsolicited messages
Ignore QR codes in unexpected emails, SMS, WhatsApp or social media messages, especially from unknown senders.
Use the phone's built-in camera
Avoid third-party scanner apps; the advisory warns some show ads that lead to phishing sites.
Read the address before opening
Check the preview for misspelt domains, extra characters or unfamiliar addresses. If it looks wrong, don't open it.
Never install an app from a QR link
Only install apps from Google Play or the Apple App Store. A page asking you to allow 'unknown apps' is a red flag.
Check payment details before you confirm
Confirm the amount and the recipient name in your banking app. If unsure, ask the business in person.
Keep phones updated
Install operating system and app updates promptly to close security holes.
If someone already scanned and entered details
Speed matters. The steps depend on what was entered.
- Work login entered: change the password from a trusted computer, tell whoever runs IT, revoke sessions and check for new mailbox forwarding rules.
- Bank details entered or money sent: call the bank's hotline immediately and make a police report.
- App installed: disconnect the phone from the internet, uninstall the app, tell the bank, and have the phone checked or reset.
- Report it: call the ScamShield Helpline on 1799 if unsure whether it's a scam, and report incidents to SingCERT.
Do it yourself or get help?
Sticker checks and staff habits cost nothing and can start tomorrow. Email filtering that decodes QR codes, and training that includes quishing examples, are where outside help pays off.
Our Security Awareness Training (S$390) sets up short lessons in your own account, including Singapore scam topics such as fake PayNow and QR scams. Email Threat Protection (S$290) tightens filtering in Microsoft 365 or Google Workspace so more phishing, including image-based lures, is caught before it reaches staff.
Frequently asked questions
Quishing is phishing that uses a QR code instead of a clickable link. The code leads to a fake login page, a payment redirect or a malware download. It arrives in emails, messages and on printed stickers. Because you can't read a QR code, people can't check where it goes until after they scan it.
Because they turn a link into an image. Staff can't hover to check the address, some email filters don't decode QR images, and scanning moves the attack to a personal phone outside company security controls. Treat any email asking you to scan a QR code to log in, verify MFA or view a document as suspicious.
Look for a sticker placed over another code, peeling edges, a different design or colour from the business's other signage, or a code in an odd place. After scanning a payment code, check the recipient name before paying. CSA and SPF advise not scanning codes that look pasted over and asking the business if unsure.
Check every displayed QR code at opening, remove stickers you didn't put up, use tamper-evident holders, and scan your own payment code regularly to confirm the payee name. Keep a photo of each genuine code so staff know what it should look like, and tell customers to check the payee name before confirming payment.
Call the ScamShield Helpline on 1799 if you're unsure whether something is a scam. Report cybersecurity incidents to SingCERT through its online incident reporting form. If money was lost, contact your bank immediately and lodge a police report. Inside a company, tell whoever handles IT straight away.