QR code phishing rose 146% in a single quarter, and the FBI says a swapped code on your invoice or storefront can move your money before anyone checks

Microsoft's security team analyzed roughly 8.3 billion email-based phishing threats between January and March 2026 using Defender for Office 365 telemetry, and flagged QR code phishing as the fastest-growing attack vector it tracked that quarter. Monthly volume went from 7.6 million attacks in January to 18.7 million in March, a 146% increase in three months [1][2].

The reason it is growing that fast sits in how a QR code is built, not in who clicks it. A standard phishing filter looks for a malicious link sitting in the text of an email. A QR code carries that same link encoded inside an image, often tucked inside a PDF attachment rather than pasted into the message body: 70% of QR phishing arrived that way in March, up from 65% in January [1][3]. The filter sees a picture or a file. It does not see a link to flag until a person scans the code on their own phone, usually a device with none of the business's email protections on it at all.

None of this is limited to email. The FBI has warned for years that criminals tamper with the QR codes businesses already print and post, a sticker over the real code on a restaurant table tent, a parking meter, or an invoice, so the same payment lands in a different account while everything else about the document still looks correct [4]. In January 2026 the Bureau issued a separate flash alert tying a state-linked group to a targeted quishing campaign, which means the same blind spot is being worked by both mass spam and deliberate attacks on specific organizations [5].

Microsoft's report is built on its own detection telemetry across Defender for Office 365, which gives it a direct view of what actually lands in inboxes rather than a survey of what people remember being sent. Independent coverage of the same report lines up on the headline figures: the 7.6-million-to-18.7-million jump, the 146% growth rate, and QR phishing's standing as the single fastest-growing category Microsoft measured that quarter ^[1][2][3]. The same report found business email compromise running at about 10.7 million attacks across the quarter, so QR phishing is not replacing other fraud, it is growing alongside it ^[1].

The PDF-delivery detail explains the mechanism, not just the trend. A text-based filter scans an email for a known-bad domain or a suspicious link string. A QR code defeats that check by design: the destination is encoded as a pattern of pixels, so there is no text link in the message for the filter to read. Wrapping that image inside a PDF buys attackers a second layer, since many filters that have learned to flag a bare QR image attached directly still wave through the same code sitting on a page inside a document. That is why the PDF-delivery share climbed from 65% to 70% in a single quarter: it is the version of the attack that is still getting through ^[1][3].

Microsoft's report also flagged a second barrier rising in parallel: phishing pages gated behind a CAPTCHA step reached their highest monthly volume in a year in March. A CAPTCHA filters out automated scanners the same way a QR code filters out text-based ones, so a security tool trying to preview where a link leads sees a human-verification screen instead of the credential-harvesting page underneath it. Two separate evasions, aimed at two separate kinds of automated detection, both spiking in the same quarter ^[1][2].

The FBI's warning about tampered QR codes predates this report by years and describes a different mechanic with the same blind spot. A criminal does not need to send anything. They print their own code on a sticker and place it over a business's real one, on a table, a sign, or a printed invoice, so a customer or a vendor scans what looks like the business's own payment link and sends money to an account the business does not control. The Bureau's guidance is blunt about what happens next: it cannot guarantee that money moved this way comes back ^[4]. The January 2026 flash alert about a quishing campaign tied to a state-linked group confirms the method is not confined to mass-market spam; the same hidden destination works just as well as a tool aimed at one specific target ^[5].

Across the US, Egypt and the Gulf, a QR code is now a default part of checkout, invoicing, and dine-in ordering, which means a growing number of businesses are relying on a surface they only check the day they print it. The fix is not a training poster. It is making sure a QR code is never the only way to reach a payment or login destination, and that whatever scans a business's email actually decodes what is inside an image or a PDF rather than only reading the text around it.