QR Codes Are the New Favorite Phishing Trick

An invoice lands in someone's inbox. Instead of a link, there's a QR code: “scan to view your statement.” It looks routine, like something a bank or a vendor would send, and it sails straight past the spam filter that would have caught the same scam as a plain text link. It's quietly become the fastest-growing phishing tactic Microsoft is tracking.

In its Q1 2026 email threat landscape report, Microsoft said it detected roughly 8.3 billion email-based phishing threats between January and March. Buried in that number: QR-code phishing attacks climbed from 7.6 million in January to 18.7 million by March, a 146% increase in a single quarter.

Why a picture of a barcode beats your email filter

Traditional phishing defenses are built to read text. They scan links, check domains, flag suspicious wording. A QR code is just an image. There's no URL for the filter to inspect until a person points a phone camera at it, and by then the click is happening on a personal device that's usually outside the company's email security altogether.

Attackers have leaned into that gap on purpose. Microsoft found that PDF attachments now account for 65–70% of QR-code phishing delivery, embedding the code inside a document specifically because attachment scanners look for malicious links and macros, not a barcode graphic sitting in a PDF. CAPTCHA-gated phishing pages (the ones that make you “prove you're human” before showing the fake login screen) followed the same logic, more than doubling to 11.9 million attacks in the same quarter. That gate blocks automated scanners while doing nothing to stop the person who's already been fooled.

What helps

• Treat an unexpected QR code exactly like an unexpected link, whether it's in an invoice, a shipping notice, a “re-verify your MFA” email, or a poster in a parking lot. If you didn't expect it, don't scan it.
• Phishing-resistant MFA matters here more than ever. A stolen password from a QR-code login page is far less useful to an attacker if the second factor can't be phished the same way.
• Mobile devices that scan work email need the same security posture as a laptop. A phone with no endpoint protection scanning a malicious QR code is a wide-open door.
• Security awareness training has to cover QR codes specifically. Most staff were trained to distrust suspicious links, not suspicious barcodes.

What we do about it

For clients on our email security stack, Safe Links and Safe Attachments extend coverage to what's inside a PDF, not just the message body, and our monthly security awareness training now runs QR-specific scenarios alongside the usual simulated phishing. If you're not sure whether your current setup would catch this, ask us. It's a five-minute conversation, not a sales pitch.