{"id":2086,"date":"2026-02-15T10:10:57","date_gmt":"2026-02-15T09:10:57","guid":{"rendered":"https:\/\/ilja-schlak.de\/?p=2086"},"modified":"2026-02-15T10:10:57","modified_gmt":"2026-02-15T09:10:57","slug":"quishing-qr-code-phishing-awareness","status":"publish","type":"post","link":"https:\/\/ilja-schlak.de\/en\/quishing-qr-code-phishing-awareness\/","title":{"rendered":"Quishing (QR Code Phishing) – How to Recognize It and Stop QR-Based Attacks"},"content":{"rendered":"

Quishing is no longer just an email problem. Attacks are shifting the \u201cclick\u201d to QR codes, postal mail, and smartphones. That changes what effective security awareness must cover.<\/p>\n

QR codes are becoming the new phishing standard<\/h2>\n

QR codes are considered convenient because they \u201conly\u201d need to be scanned. That very convenience is increasingly being exploited as an entry point. The key difference from classic phishing is not the look and feel, but the channel shift. The scan often happens on a smartphone, while security controls on the corporate endpoint and in email gateways are bypassed.<\/p>\n

A recent note in the FBI\/IC3 flash on Quishing<\/a> describes this mechanism explicitly. Attackers embed a malicious URL in a QR code, force a switch from the corporate device to a mobile device, and thereby circumvent common email protection mechanisms. Particularly relevant is that quishing campaigns often lead to credential harvesting and then to session token theft, enabling identity takeover in cloud environments.<\/p>\n

When \u201csupport mail\u201d arrives, it\u2019s no longer an edge case<\/h2>\n

Awareness programs are often optimized for email. That makes sense, but it is now incomplete. In practice, there are increasing scenarios where physical letters, printed notices, or inserts in packages provide the initial foothold. Typical is a staged narrative with urgency, an alleged required action, and a QR code positioned as the \u201cfastest way\u201d to resolve the issue.<\/p>\n

Wallet manufacturers now explicitly warn that they do not request seed phrases or backups and that postal contact should also be treated as an indicator of fraud. In the Ledger guidance on ongoing phishing campaigns<\/a>, it is emphasized that the recovery phrase must never be shared or entered anywhere and should only ever be used directly on the device. The Trezor guide on scams and phishing<\/a> is equally clear: unsolicited contact via messenger, phone, and even postal mail should be treated as phishing.<\/p>\n

Why finance, executives, and wallet users are especially affected<\/h2>\n

Attackers care about two things. They want either immediate monetization or to compromise identities that grant access to money flows and sensitive systems in the next stage.<\/p>\n