QR code phishing is a social-engineering tactic that uses a scannable code to send a victim to a fake login page, a malware download, or another attacker-controlled action. It is effective because the code hides the destination from a quick visual check and often moves the target from email or chat to a mobile browser, where security cues are easier to miss.
In real attacks, QR codes may appear in fake invoices, event invitations, posters, or documents. They can be used alone or as part of a larger phishing chain that steals credentials, session cookies, or MFA tokens. Defenders should treat unexpected QR codes as suspicious, verify the destination before opening it, and prefer phishing-resistant sign-in methods such as passkeys or hardware security keys. URL filtering, user awareness, and rapid session revocation also reduce the impact when a scan leads to a malicious site.