# Quishing

Quishing is phishing through a QR code, so the malicious link is hidden in an image that email filters and users cannot read at a glance.

## How it works

QR codes appear in emails, PDF attachments, parking meters and posters. Scanning them opens the link on a phone, outside the protections of a work computer.

The destination is usually a credential or payment page; physical stickers over genuine codes are also common.

## How to protect yourself

- Check the URL a scanner shows before opening it; be wary of codes in emails and on stickers.
- Decode suspicious codes with a tool that shows the link defanged.

## Related tools

- [QR Code Decoder](https://phishdestroy.io/developer-tools/qr-decoder)
- [URL Defanger & IOC Extractor](https://phishdestroy.io/developer-tools/url-defanger)

## Related terms

- [Smishing](https://phishdestroy.io/glossary/smishing/)
- [Defanging](https://phishdestroy.io/glossary/defanging/)

## Further reading

- [Why Email-Only Abuse Reports](https://phishdestroy.io/why-email)

## Glossary

- [All terms](https://phishdestroy.io/glossary/)

Canonical: https://phishdestroy.io/glossary/quishing/