What Is QR Code Phishing and Why Are UK Businesses Falling for It?

A phishing email doesn't need a virus, a dodgy link, or bad spelling anymore. Some of the sharper ones now arrive as a completely clean Word document with a company logo, a believable message, and a QR code sat in the middle of the page asking you to scan it with your phone. No warning triangle from your email software. Nothing for your antivirus to catch. Just a code, and a reason to scan it.

This is called QR code phishing, or "quishing," and it's becoming one of the more common ways scammers get into UK businesses right now. Here's what one of these attacks actually looks like, and how to spot the next one before it does any damage.

What Is QR Code Phishing (Quishing)?

Quishing is a scam email that hides its malicious link inside a QR code instead of a normal clickable link. The email itself often looks completely ordinary, a policy update, a delivery notice, an HR document, a supplier invoice. The only action it asks for is to scan the code with your phone camera.

That small difference matters more than it sounds. Most company email security is built to check links and attachments for anything suspicious. A picture of a QR code doesn't look like a link to that software. It looks like an image. So, it sails straight through the filters that would normally catch this sort of thing.

Why Do Scammers Use QR Codes Instead of a Normal Link?

Because it moves the click somewhere your IT team can't see it.

Once you scan a QR code with your phone, you've left the laptop, the company network, and whatever security software your business runs. You're now on your personal mobile browser, which usually has none of that protection. If the code leads to a fake login page and you type in your work email and password, that goes straight to the scammer, and nobody on your IT side ever saw a link, an attachment, or anything else to flag.

It also plays on trust. A QR code feels like something from a menu, a poster, or a legitimate company document. Most people don't treat it with the same suspicion they'd give a strange link in an email.

How Did a Recent Version of This Scam Work?

We looked closely at one example sent to a UK business. It arrived under the name of an HR department, addressed to one specific employee, mentioning a pay rise and updated benefits, both good reasons to open something quickly. The sending address had nothing to do with the real company it claimed to be from.

Attached was a Word document with the company's actual logo copied in, formatted to look exactly like a genuine staff handbook. Inside, a short message told the employee to scan a QR code to view the "full policy update," with a warning that the document was confidential and shouldn't be shared. That warning wasn't there to protect anyone. It was there to stop the employee forwarding it to IT for a second opinion.

The QR code itself led to a page built on free cloud hosting, the kind that takes seconds to set up and just as long to take down and rebuild elsewhere. The link even had the employee's own email address built into it, so a fake login page could greet them by name and look more convincing.

Nothing about this attack was technically clever. It relied entirely on a good logo, a believable tone, and a QR code doing the one job a normal link couldn't do: getting past the filter.

What Are the Warning Signs of a Fake QR Code Email?

A few things tend to show up together in these emails:

• The sender's name doesn't match their actual email address when you check it closely

• There's pressure to act fast, tied to money, pay, or a benefits deadline

• The message tells you to keep it confidential or not to share it with colleagues

• The only way to see the "real" content is by scanning a code, never by clicking a normal link

• It's addressed to you personally, using details a scammer could easily find online

None of these on their own proves anything. Together, in one email, they're a strong signal to stop and check before doing anything else.

What Should You Do If You Get One of These Emails?

Don't scan the code. If a colleague already has, get their device checked and their passwords changed straight away.

Report the email to whoever manages your IT or email security so they can block the sender and warn other staff. If the email is impersonating a real supplier or partner, let that company know too, since their name is being used without their knowledge. And if you're ever unsure whether a document is genuinely from HR or a supplier, check through a system you already log into rather than a fresh attachment or code, particularly one that's arrived out of nowhere.

Can a Virtual Desktop Setup Reduce This Risk?

To an extent, yes. Businesses running virtual desktops keep company data off personal devices entirely, so even if someone did scan a code and land on a fake page, there's less sat on that device for a scammer to reach. It won't stop someone typing a password into a convincing fake page, but it does limit what a stolen password can actually get to.

If you're weighing up whether managed IT support is worth it for a small or growing business, our FAQ page covers the questions we get asked most often, including how quickly threats like this get caught and reported.

Quishing works because it looks ordinary. The best defence isn't technical at all. It's a habit of pausing before scanning anything unexpected, and treating a QR code in an email with exactly the same suspicion you'd give a strange link, because that's precisely what it is.