Cybersecurity Glossary
Quishing
Quishing that hides the malicious link inside a QR code, so no address is visible before you scan.
What Quishing means
A QR code is an image, so the usual defences struggle with it. Mail filters see a picture rather than a link, and the recipient sees no address to check. Codes turn up in parking notices, invoices, meeting invitations and posters, and they often send the victim to a personal phone that has none of the company protections.
Why Quishing matters for small businesses and nonprofits
Small teams are the sweet spot for this because the phone in someone's pocket is usually outside the managed environment. A code stuck over the real one on a payment terminal or an invoice costs nothing to produce and pays immediately.
What to do about Quishing
- Type the address yourself for anything involving payment or a login, rather than scanning
- Bring phones that touch company mail into the same management and protection as laptops
- Tell the team that a QR code in an unexpected message deserves the same suspicion as a link
Not sure where you stand on this?
We review your current setup against the basics, tell you plainly what is covered and what is not, and give you a ranked list with effort and cost. No jargon and no scare tactics.
Phishing that hides the malicious link inside a QR code, so no address is visible before you scan.