QR codes have become an everyday tool for making payments, accessing menus, and connecting to digital services. But this familiarity has also been exploited by cybercriminals to give a new boost to online fraud. The security company ESET has detected a significant increase in quishing, a variant of phishing that uses these dotted codes to direct users to malicious websites without them being able to read the destination URL.
The latest figures speak for themselves : the ESET Threat Report H1 2026 indicates that malicious QR codes appear in 11% of all phishing emails, with an average of over 100.000 detections per month. In fact, Spain ranks second in the world in the number of attacks of this type, second only to the United States.
What is quishing and why is it booming?
Quishing is essentially a variant of classic phishing, but with an extra element: the malicious link is hidden within a QR code. The user scans the image and ends up on a fraudulent website that can steal their bank passwords, login credentials, or even install malware on their device.
One of the reasons for its success is that the link's destination isn't immediately visible. In a suspicious email, you can see the illegitimate domain; here, everything is compressed into a square of pixels. Furthermore, these codes are embedded in messages as an attached image or PDF, bypassing many email security filters. And the trick is even more effective because it moves the communication from the work computer to the mobile phone, a device that often doesn't have the same level of protection.
Social engineering also plays a significant role. Criminals use the image of well-known brands, such as DocuSign or Microsoft, and exploit urgent situations, for example, by warning that the account will be suspended if it isn't authenticated. As a result, the message arrives in the inbox, and the employee doesn't find any of the usual phishing indicators because there's no text to read in the link.
Quishing in Spain, an alert that doesn't stop
Spain has become a major hotspot for this type of fraud. ESET estimates that 17% of global quishing detections are concentrated in the country, confirming that the technique has found fertile ground. One of the most representative cases was resolved thanks to the intervention of the National Cybersecurity Institute (INCIBE). A restaurant customer scanned the QR code on the menu, which had been altered, and unknowingly subscribed to a premium service.
The OCU (Spanish Consumers' Organization) has also highlighted the issue of fake QR codes being affixed to cars to simulate traffic fines. When the victim scans the code to pay the fine, they hand over their card details to a fraudulent website. These scams don't stop there: stickers with fraudulent QR codes have been seen covering the genuine codes of parking meters and shared bicycles. The attackers cover the original with a printed code that points to their own domain.
ESET labs indicate that April 2026 marked the peak of detections, although the time series had already begun to show a steady increase. Mobile security and corporate email are the main shield, but lax user habits are doing the rest.
The other sides of QR fraud
It's not all about massive fraud against restaurant customers. The U.S. Internal Revenue Service (IRS) has also detected campaigns involving physical letters disguised as tax notices, containing a QR code that promises account verifications or documentation for cryptocurrency owners. Scanning the code takes the victim to a website that requests seed phrases or private keys—the element that grants control over digital funds.
The role of states is also behind these traps . An FBI advisory from January 2026 mentioned the Kimsuky group, allegedly linked to North Korea, as responsible for QR code cyberespionage attacks in which they used pretexts such as government documents or forms to gain access to research organizations. In other words, the technique has also infiltrated the arsenal of APT groups, with the aim of compromising high-value networks.
How to protect yourself against quishing
The main defense against this fraud is something as basic as learning to be skeptical. INCIBE recommends pausing before scanning any QR code posted in a public place. If the sticker appears peeling, shows signs of tampering, or is directly over another code, it should not be used. In the case of emails, be wary of any unsolicited message urging you to scan a QR code, especially if it contains excessive time pressure.
It's also a good idea to check the URL the code leads to. If your phone offers a link preview, look for typos, shortened domains, or strange variations of familiar websites. Disabling automatic link opening when scanning a QR code is another useful layer of protection, on both iOS and Android systems. And never provide payment information, credentials, or wallet details without verifying through a different channel that the request is legitimate.
For businesses, ESET experts recommend including quishing in awareness programs and phishing simulations. Technology is another key element: email filters capable of extracting and analyzing QR codes in files, protection for corporate mobile devices, and phishing-resistant authentication for high-privilege accounts. Applying the principle of least privilege and keeping software up to date are additional steps that prevent a malicious scan from becoming a critical network compromise.
The popularity of QR codes is nothing new, but neither is the threat posed by them. Quishing has become established as a threat that moves data through a screen and a binary code, and the measures that work for text-based phishing also work here if applied with common sense. Spain is already in the crosshairs, and the difference between becoming a victim and avoiding a scare depends on that simple habit of checking, before scanning, that the destination isn't a scam.