A QR code is a link you cannot read. You can glance at tuj-events.example.com and sense something is off, but a grid of black squares cannot be checked in the same way. That blind spot is why “quishing” or QR phishing became one of the fastest growing attack methods of 2026.
The numbers prove to be quite substantial on this issue. Microsoft’s threat intelligence team counted 7.6 million QR phishing emails in January 2026 and 18.7 million in March, a 146% rise in a single quarter, which made QR codes fastest growing attack vector in its email data [1]. ESET separately found malicious QR codes in about 11% of all the phishing emails it detected in the first half of 2026 [2].
Why do scammers like QR codes so much? Email filters are built to inspect links as written as text. A QR code is an image which is usually inside of an attachment. By March 2026, PDF’s carried 70% of the QR phishing Microsoft tracked [1]. The second advantage the switch between devices. You read the email on a laptop that may have browser protections, then you scan with your phone. This increases the probability of clicking on a malicious link as the link that appears is often small and hard to read, and people often click on links that appear without reading carefully due to reflex and convenience.
There are three common ways that QR scams are often carried out and it is important to understand each one individually and how they differ. Understanding each tactic used by malicious actors helps prevent you from falling victim to this rapidly growing scam.
The first is placing a sticker over a reputable code. For example, an malicious actor can print out their own QR code and carefully cover a legitimate code on a rental bike, parking meter or a restaurant table. In 2024, police in Redondo Beach, California found at least 150 fake codes on city parking pay stations, each leading to a copy of a payment page [3]. The Federal Trade Commission has also warned of the same tactic [4]. It works anywhere a code handles money, and with PayPay and other QR payment apps that are part of daily life in Japan, that can cover many places.
The second method can be found in your email inbox. Say you get an email saying that a package could not be delivered or your password must be rest after “suspicious activity” and instead of being provided with a link, a QR code is attached. The FTC lists these exact excuses [4]. The solution here is to understand that legitimate services will almost never ask you to scan a QR code from an email in order to log in.
The third approach to these scams can be seen on fliers that advertise some sort of prize. This could range from free concert tickets, a part time job paying well above the going rate, or even a grant for international students. These fliers often exist with the sole purpose of getting a scan so that a malicious actor can obtain sensitive information such as a student login, LINE account credentials, credit card numbers and more. If something appears too good to be true, that’s usually because it is.
So adversaries have multiple methods of using QR code scams and their innovation to scam unsuspecting people seems to continuously grow. How can you make sure you never fall victim to this type of attack with these ever evolving tactics?
The first thing to do when you scan a QR code is to slow down and carefully read the link preview that pops up after you scan. QR codes may not have any visible red flags, however a link that you can read may show potential signs of an untrustworthy destination. Secondly, we recommend to never log in if prompted by a QR code. Instead it would be a safer decision to open up the official portal or website yourself which allows you to skip the potential risk of QR codes entirely by reaching the intended address yourself. Third, if you suspect that a QR code may have been tampered with, we advise touching the physical code to check for raised edges to identify any potential stickers. The fourth tip and often overlooked is to rely on your devices camera to scan for QR codes. The FTC advises against using separate QR code scanner apps. Lastly, be extremely cautious of any QR codes sent via email. As stated earlier links are rarely sent only as QR code without any visible link to inspect.
What do you do if you discover a suspicious code? Photograph it but do not scan it and take note of where you saw it, then tell the building manager or shop owner so it can be taken down. Phishing emails can be reported to the Council of Anti-Phishing Japan at [email protected]. If you have already entered card details, sensitive login credentials or any other compromising information to a suspicious code, immediately call your card company or organization to which the credentials fall under. The Consumer Hotline (188) can advise on losses. Finally, if you are a university student and you observe any potential QR code scams on campus, notify university staff as soon as possible and send the TUJ Cyber Shield Club information on the scam you discovered so we can report on these matters and continue to keep students and staff alike safe on campus grounds.
Sources
- Microsoft Threat Intelligence. "Email threat landscape: Q1 2026 trends and insights." April 30, 2026. microsoft.com
- ESET / WeLiveSecurity. "How QR-code phishing can slip past corporate security measures." 2026. welivesecurity.com
- Gizmodo Japan. "そのリンク先は正しい? 「QRコード詐欺」にご注意を." September 2024. gizmodo.jp
- CNBC. "QR codes may be a gateway to identity theft, FTC warns." December 7, 2023. cnbc.com
