QR Code Phishing Is Surging: How Southwest Florida Businesses Can Stop “Quishing”

A QR code arrives in an email that looks like a Microsoft 365 security notice. It says an employee must scan the code to keep multifactor authentication active. Another code appears on an invoice, a voicemail notification, a document-sharing alert, or a package delivered to the office.

The request feels routine. The employee points a phone camera at the square image, taps the link, and sees a familiar sign-in page.

That simple scan can move an attack from a company-controlled inbox and computer to a less visible device. If the page is fake, the employee may hand an attacker a password, an authentication code, personal information, or payment details. In some cases, the site may prompt the person to install an application or grant permissions.

This attack is commonly called QR-code phishing or quishing. It deserves attention now: Microsoft’s 2026 Digital Defense Report says Microsoft Defender for Office 365 detected more than 145 million QR-code phishing attacks between July 2025 and June 2026. That number describes detections, not successful compromises, but it shows the scale at which attackers are using the technique.

For small and midsize organizations in Southwest Florida, the answer is not to ban every QR code. Restaurants, medical practices, property managers, contractors, associations, local governments, professional firms, and hospitality businesses all use legitimate QR codes. The better approach is to close the gap between email security, identity protection, mobile access, payment controls, employee judgment, and incident response.

What is QR-code phishing?

A QR code is a machine-readable image that usually sends a phone or tablet to a web address. In a legitimate workflow, it might open a menu, a payment page, an event registration form, a shared document, or an authentication setup process.

In a quishing attack, the code points to a destination controlled or abused by an attacker. The first page may be the final fake site, or it may redirect through several services before reaching a credential-harvesting page. The message surrounding the code supplies the pressure: scan now to review a file, listen to a voicemail, prevent an account lockout, confirm payroll, pay an invoice, or re-register security information.

The image creates two advantages for the attacker:

1. The destination is not immediately readable by a person. A normal hyperlink displays text and may reveal its target when a user hovers over it. A QR code asks the recipient to trust an image and a short camera preview.
2. The scan often transfers the interaction to a mobile device. The original email may be open on a managed computer, but the credential entry happens in a phone browser—sometimes on a personal phone outside the organization’s security monitoring.

Microsoft has added image detection, threat signals, and URL analysis that extract QR codes from email content and help block QR-based phishing. That is important protection, but no email filter is perfect. QR codes can also appear in PDFs, printed letters, packages, signs, stickers, text messages, or collaboration platforms. A layered defense remains necessary.

Why the mobile handoff matters

Many businesses think of phishing as an email problem. Quishing is better understood as a connected identity, endpoint, and process problem.

Consider the path of a typical attack:

1. A message containing a QR image reaches an employee.
2. The employee scans it with a phone.
3. The phone opens a web page that resembles Microsoft, a bank, a vendor portal, or another trusted service.
4. The employee enters a password, authentication code, payment information, or other sensitive data.
5. The attacker attempts to use that information, steal an authenticated session, enroll another authentication method, change payment instructions, or continue the fraud through the compromised account.

On a phone, the browser’s address bar may be shortened or hidden. The user may be multitasking. A personal device may not have the organization’s web filtering, mobile threat protection, or management policies. Security teams may see the original email but not the later browsing activity.

There is also a physical version of the problem. A criminal can place a sticker over a legitimate QR code on a sign, payment station, flyer, or printed notice. Businesses that publish their own codes therefore need a physical inspection process as well as an email defense.

Who is most affected?

Any organization whose employees use email and smartphones can be targeted, but several Southwest Florida workflows deserve extra attention.

Finance and executive teams

Employees who approve invoices, wire transfers, payroll changes, gift-card purchases, or vendor updates are valuable targets. A QR code may lead to a fake sign-in page before the attacker sends a convincing payment request from a compromised mailbox.

Real estate, title, construction, and property management

These businesses exchange documents, inspection reports, closing information, work orders, payment notices, and portal invitations with many outside parties. Urgent mobile communication is normal, which gives an attacker plausible cover.

Healthcare, dental, and professional practices

Patients, clients, insurers, referral partners, and vendors create a large flow of messages and portals. A compromised identity can expose sensitive information and interrupt scheduling, billing, and communications.

Hospitality, restaurants, retail, and event operators

QR menus, guest information, promotions, ticketing, Wi-Fi access, and payments are common. A fraudulent sticker or replaced sign can target customers as well as employees and harm the organization’s reputation.

Nonprofits, associations, and local public-service organizations

Small administrative teams often handle donations, registrations, board communications, and community notices with limited security staff. Attackers can exploit trusted names and time-sensitive community events.

Mobile and field-based workers

Contractors, salespeople, technicians, home-health staff, and property teams routinely work from phones. The device may be the fastest way to complete a task—and the least monitored place to encounter a malicious QR destination.

A practical protection plan

The goal is to make one failed control survivable. A suspicious message might reach an inbox, but the employee recognizes it. A person might scan a code, but identity controls prevent account takeover. A password might be exposed, but the organization detects the sign-in and responds before fraud spreads.

1. Treat an unexpected scan request like an unexpected link

Employees should be cautious when a QR code asks them to sign in, re-register multifactor authentication, install an application, approve a payment, or provide personal information. Urgency, secrecy, and threats of account closure are warning signs.

If the request claims to come from a known provider, the employee should open the provider’s official app or type the known website address independently. They should not use contact details or a phone number supplied by the suspicious message.

2. Preview the destination before opening it

Most current phone cameras show a destination preview. Users should pause and inspect the domain—not merely the logo or page design. Misspellings, extra words, unfamiliar shortened links, and unexpected domains are reasons to stop.

Previewing is not proof of safety. A legitimate-looking service can redirect elsewhere, and an attacker may abuse a real cloud platform. The safest response to an unexpected account or payment request is to navigate independently and verify through a separate channel.

3. Use phishing-resistant authentication where practical

Traditional multifactor authentication is much better than a password alone, but a fake site can sometimes relay a password and one-time code in real time. Passkeys and FIDO2 security keys are designed to resist conventional phishing because authentication is bound to the legitimate service.

Organizations should prioritize phishing-resistant methods for administrators, owners, finance personnel, executives, and other high-impact roles. Migration must be planned carefully: account recovery, shared-device scenarios, emergency access, lost devices, and user support still require human oversight.

4. Review Microsoft 365 protection—not just licensing

Microsoft 365 includes different protections depending on the subscription and configuration. A purchased license does not guarantee that every recommended policy is active or correctly scoped.

A review should cover:

• Exchange Online Protection and Microsoft Defender for Office 365 coverage;
• Standard or Strict preset security policies where appropriate;
• anti-phishing, impersonation, Safe Links, and Safe Attachments policies;
• quarantine behavior and who can release messages;
• user and admin reporting workflows;
• alerts, investigation, and response ownership;
• mail-flow exceptions, allow-list entries, and third-party gateways that may weaken inspection; and
• actual licensing for every user expected to receive a feature.

Microsoft’s current guidance notes that some additional impersonation and phishing-threshold settings are not enabled in the default Defender for Office 365 anti-phishing policy. This is why a configuration assessment matters.

5. Connect mobile access to identity policy

If employees can reach company email and files from phones, mobile risk belongs in the security plan. Depending on the organization’s needs and licenses, controls may include device compliance, Conditional Access, application protection, approved-app requirements, mobile threat defense, and restrictions on high-risk sign-ins.

The right design is not automatically “manage every personal phone.” A business must weigh privacy, usability, legal requirements, staff roles, and the sensitivity of the data. The important point is to make an explicit decision rather than allow ungoverned mobile access by default.

6. Run QR-specific security awareness exercises

Generic annual phishing training is not enough. Employees need to recognize the mobile handoff and practice reporting it.

Microsoft’s Attack Simulation Training supports built-in and custom QR-code payloads for several social-engineering techniques. Any simulation should be authorized, safely configured, proportionate, respectful of employees, and followed by useful coaching. The purpose is to strengthen behavior and reporting—not embarrass people.

Training should include physical QR codes, vendor-payment scenarios, fake Microsoft 365 notices, document-sharing lures, and what to do after an accidental scan.

7. Strengthen sender and impersonation controls

SPF, DKIM, and DMARC help receiving systems evaluate whether messages claiming to come from a domain are authorized. They do not solve every phishing attack—criminals can register lookalike domains or compromise legitimate accounts—but properly deployed email authentication reduces spoofing opportunities.

Protect high-risk internal identities and important external brands with impersonation controls. Use external-sender indicators thoughtfully, and make sure staff understand that a message from a compromised partner can still be dangerous.

8. Inventory business-owned QR codes

Organizations that display QR codes should know where they are, what each code is supposed to do, and who owns the destination. Use tamper-evident materials where justified, inspect public codes routinely, and remove outdated signage.

For important workflows, print a recognizable short web address next to the code so customers and staff have an alternative. Keep the landing domain under organizational control, use HTTPS, monitor for unauthorized changes, and avoid destinations that unexpectedly demand credentials or payment information.

9. Require independent verification for money and account changes

No QR code, email, or mobile page should be able to change a vendor’s bank account, initiate a wire, redirect payroll, or authorize a sensitive purchase by itself. Confirm high-risk changes through a known phone number or another established channel. Use dual approval and documented thresholds.

This human control is deliberately slower. The small delay is a feature when the alternative is irreversible fraud.

10. Prepare a scan-and-response playbook

Employees need a simple answer to “I scanned it—what now?” Fast reporting should be rewarded. A short reporting delay can give an attacker time to use a stolen session or send messages from the victim’s account.

The playbook should identify who receives the report, how to preserve the message and code, when to isolate or inspect the phone, who contacts banks or insurers, and who makes business-continuity decisions. Test the playbook before an incident.

What to do after a suspicious QR code is scanned

Scanning does not automatically mean the device or account is compromised. The response should match what happened.

If the employee only opened the page and entered nothing, they should close it and report the message or physical code. Security personnel can preserve the evidence, analyze the destination safely, search for other recipients, and block confirmed malicious indicators.

If the employee entered a password, authentication code, or approved a prompt, the organization should treat the identity as potentially compromised. Response may include resetting credentials from a trusted device, revoking active sessions and tokens, reviewing authentication methods, checking recent sign-ins, examining inbox rules and forwarding, reviewing application consent, and hunting for messages sent from the account.

If software was installed or permissions were granted, the device requires qualified review. Do not rely on the employee to “look around” the suspicious application. Personal-device handling must follow the organization’s policy and applicable privacy or legal requirements.

If money or financial information was involved, contact the bank or payment provider immediately using a verified number. Preserve timestamps, messages, domains, transaction information, and other evidence. Fraud may also be reported to the FBI’s Internet Crime Complaint Center at IC3.gov.

Incident decisions should not be delegated entirely to an automated tool. Disabling an account, wiping a device, or blocking a widely used service can disrupt operations or destroy useful evidence. A trained responder should validate scope and choose proportionate actions.

Where AI helps—and where it does not

AI and machine learning can strengthen QR-code defenses when they are part of a governed security process.

Security products can use image analysis to find QR codes in messages and attachments, extract the encoded destination, examine redirect chains in a protected environment, compare visual and language patterns, and correlate the message with identity, endpoint, and threat intelligence signals. AI can also help cluster similar messages, summarize an incident timeline, prioritize alerts, and identify users who received the same lure.

These capabilities are especially useful at machine speed and scale. A small IT team cannot manually decode every image or correlate every sign-in.

But AI does not make the final business decision. Legitimate QR codes are common, and automated analysis can produce false positives or miss a new technique. An AI assistant should not be allowed to scan live malicious destinations on an unmanaged device, release quarantined mail, disable accounts, or block a common cloud service without appropriate controls and review.

Human judgment is essential for deciding whether a vendor request is genuine, whether a physical code has been altered, whether an identity action will interrupt patient care or business operations, and whether an incident requires legal, insurance, banking, or law-enforcement involvement. AI can accelerate evidence gathering; accountable people must own the risk decision.

Business continuity: security without breaking useful workflows

QR codes are useful because they connect physical and digital processes quickly. A blanket ban may push employees toward unofficial workarounds or harm customer service. A resilient program distinguishes approved uses from unverified ones.

Document the business processes that depend on QR codes. Give each important workflow an owner, an approved domain, and a fallback such as a typed URL, phone number, printed instructions, or staffed process. This is particularly important during storms, evacuations, power disruptions, or other emergencies, when people may receive urgent messages and normal verification channels may be strained.

Emergency communications should use previously established channels and recognizable domains. Staff should know that urgency does not eliminate verification. The organization should also consider accessibility: a QR-only process may exclude people who cannot scan a code or do not have a suitable device.

Good security preserves the service while reducing the chance that convenience becomes a single point of failure.

How Managed Intelligence Advisors can help

Managed Intelligence Advisors helps Southwest Florida organizations turn this issue into a practical, prioritized plan. That can include:

• assessing Microsoft 365 email, identity, and Defender configurations;
• identifying gaps between licensed capability and active protection;
• reviewing administrator, finance, executive, and other high-impact accounts;
• designing phishing-resistant authentication and safer account-recovery processes;
• aligning mobile access, Conditional Access, device management, and privacy requirements;
• evaluating email authentication and impersonation defenses;
• developing QR-specific awareness exercises and reporting procedures;
• inventorying public-facing QR workflows and continuity alternatives;
• documenting payment verification and change-control safeguards; and
• building and testing an incident-response playbook that connects technical action with business leadership.

The objective is not another isolated security product. It is a defensible operating model: technology filters what it can, employees recognize and report suspicious activity, high-risk business processes require verification, and qualified responders know what to do when a scan occurs.

Suggested call to action: Request a QR Phishing, Mobile Access, and Microsoft 365 Security Readiness Review from Managed Intelligence Advisors.