# QR Code Phishing Statistics 2026: Quishing Trends and Analysis Source: https://keepnetlabs.com/blog/qr-code-phishing-trends-in-depth-analysis-of-rising-quishing-statistics Published: 2024-01-15 Updated: 2026-11-12 Author: Ozan Ucar, Founder and CEO of Keepnet Category: Social Engineering > Discover the 2026 QR Code Phishing trends: From sophisticated quishing scams to preventive measures. Explore QR code phishing statistics and real quishing examples in 2026 to understand their impact and implications for cybersecurity. In 2026, [QR code phishing](https://keepnetlabs.com/products/quishing-simulator) has become a significant concern for individuals and businesses. With the increased use of Quick Response (QR) codes for various transactions and information sharing, malicious actors have found a ground for exploiting unsuspecting users. This blog post explores the latest **QR code phishing statistics**, shedding light on the scale and sophistication of these scams. We aim to provide readers with a comprehensive understanding of the current landscape of **QR code-related fraud**, offering insights into the most common tactics used by scammers and their impact on victims. ## QR Code Phishing Statistics 2026 In 2025, [quishing attacks](https://keepnetlabs.com/blog/understanding-quishing) surged significantly, reflecting a broader trend in social engineering tactics. Nearly **90**% of these attacks are crafted to steal login credentials and other sensitive data, commonly targeting corporate email systems, cloud storage platforms, and remote access tools. (Source) **The use of AI has made quishing attacks more advanced**, allowing cybercriminals to quickly create realistic phishing pages, tailor scams to individual targets, and adjust their methods on the fly. This has made quishing harder to detect and more effective across a wide range of industries. ### QR Code Phishing Incidents Rise in 2023 -2025 ![Chart: 8,878 QR code phishing events detected from June to August 2023, 5,063 of them in June](https://timely-benefit-e63d540317.media.strapiapp.com/From_June_to_August_2023_qr_e5412a20fc.jpg) *Image 1: Number of QR code phishing cases reported in June 2023* Systems detected 8,878 such incidents, indicating a worrying shift in cybercriminal tactics. June witnessed the peak of this trend, with 5,063 reported cases in **QR code phishing statistics**. ([Linkcpa report](https://www.linkcpa.com/the-rising-threat-of-qr-code-phishing-what-you-need-to-know/)) As attackers increasingly embed malicious QR codes into emails, they exploit users' trust in visual simplicity and mobile-first habits. ### Low Detection and Reporting Rates of QR Code Phishing Attacks ![Chart: only 36% of QR code phishing incidents were correctly identified and reported by recipients](https://timely-benefit-e63d540317.media.strapiapp.com/only_36_of_these_incidents_were_accurately_identified_and_reported_by_the_recipients_147ea62a60_dbf70b4315.jpg) *Image 2: Only 36% of QR code phishing attacks were accurately identified.* These **QR codes phishing statistics** reveal that the low detection and reporting rate is a concerning aspect of these attacks. Only **36**% of these incidents were accurately identified and reported by the recipients. This gap in security awareness and preparedness leaves many vulnerable to the risks associated with deceptive [**QR phishing**](https://keepnetlabs.com/products/quishing-simulator). ### Targeted Industries: The Primary Victims of QR Code Phishing ![Chart: the energy sector received 29% of over 1,000 malware-laden QR code emails, the most of any sector](https://timely-benefit-e63d540317.media.strapiapp.com/the_energy_sector_is_the_most_vulnerable_receiving_29_of_over_1_000_malware_infested_qr_code_emails_505937d9ea_495ef00640.jpg) *Image 3: The energy sector is the most vulnerable to QR code phishing campaigns.* Analysis reveals that these Quishing campaigns more frequently target certain industries. These **quishing statistics** underscore that the Energy sector is the most vulnerable, receiving **29**% of over **1,000** [malware-infested phishing email QR codes](https://keepnetlabs.com/blog/3-most-common-examples-of-malware-attacks). These **QR code phishing statistics** also show that manufacturing, Insurance, Technology, and Financial Services sectors are also at high risk, indicating a strategic focus by cybercriminals on sectors they perceive as either more lucrative or vulnerable. ### QR Codes: A Preferred Tool in Phishing Campaigns ![Chart: 26% of all malicious links were embedded in QR codes](https://timely-benefit-e63d540317.media.strapiapp.com/26_of_all_malicious_links_were_embedded_in_qr_codes_highlighting_the_significant_reliance_of_attackers_on_this_method_d72c5d010c_jp_243286c5bb.jpg) *Image 4: 26% of all malicious links were embedded in all QR codes.* ### Projected Growth in QR Code Payment Systems and Associated Risks ![Infographic: global QR code payments projected to exceed $3 trillion by 2025, up from $2.4 trillion in 2022](https://timely-benefit-e63d540317.media.strapiapp.com/By_2025_global_expenditures_via_QR_code_payments_will_be_projected_jpg_1ea4122470.jpg) *Image 5: By 2025, global expenditures will exceed $2.4 trillion through QR code payments* This growth, especially in markets like India, opens up vast opportunities for fraudulent QR code schemes, presenting a significant challenge in digital security. ### Malicious QR Codes Account for Nearly 2% of All Scanned QR Codes In a recent analysis, it was revealed that nearly **2**% of all scanned QR codes were malicious. This **quishing statistic** highlights the growing threat of QR code phishing, where cybercriminals embed harmful links and malware into seemingly harmless codes. As QR codes become increasingly popular for various applications, the risk of encountering malicious ones rises. ### Credential Phishing: Dominant Threat in QR Code Attacks [**Credential phishing**](https://keepnetlabs.com/products/phishing-simulator) emerged as the primary threat in QR code attacks, with approximately **89.3**% of detected incidents aimed at stealing login information and other sensitive data. This **qr code phishing statistic** highlights the urgent need for enhanced security measures and awareness to protect valuable credentials from cybercriminals. ### Industry Impact: Retail Sector Most Vulnerable to QR Code Phishing Different industries exhibit varying susceptibility levels to QR code phishing attacks. The retail industry, in particular, had the highest miss rate, indicating that a significant portion of employees struggled to identify and report suspicious QR codes. These quishing statistics underline the importance of industry-specific training and vigilance to combat the growing threat of QR code phishing. ## 69 Quishing Statistics and Trends Here is a numbered list of 69 quishing statistics and trends, compiled from 2026 sources with resources noted: - QR-based phishing emails surged from approximately 47,000 in August to over 249,000 in November 2025. - APWG logged 1,003,924 phishing attacks in Q1 2025 with a notable spike in QR-code (“quishing”) lures. - Executives face 42x more QR code attacks than average employees. - Nearly 2% of scanned QR codes are malicious. - 89.3% of QR attacks aim at credential theft. - Only 36% of QR phishing incidents accurately identified and reported. - Energy sector receives 29% of malware-infested quishing emails. - Retail has the highest miss rate for detecting malicious QR codes. - Security training improves QR phishing detection by 87% in three months. - Average business loss from quishing exceeds $1M per incident. - 26% of malicious links embedded in QR codes in phishing campaigns. - 41% of phishing involves multi-channel attacks including quishing. - 26% of phishing with URL redirects use QR codes. - 331% year-over-year increase in QR code phishing campaigns ([Cofense](https://keepnetlabs.com/blog/keepnet-cofense-alternative) data). - Half a million phishing emails with QR in PDFs detected mid-2024. - 90% of QR attacks are credential phishing. - 27% of quishing uses fake MFA notices. - 21% of QR attacks involve fake shared document notifications. - QR scans quadrupled to 41.77M globally by 2025. - 12% of quishing hides codes in PDF/JPEG attachments. - 56% of quishing emails involve Microsoft 2FA resets. - 48.6% of HR/IT phishing emails (often QR-based) are highly effective. - 18% of quishing targets online banking pages. - Only 39% of consumers can identify malicious QR codes. - 36% of Germans have scanned suspicious QR codes. - 20x surge in QR phishing in fall 2023. - Engaged employees have 40% miss rate vs. 90% for disengaged. - 73% of Americans scan QR without verification. - Over 26M Americans directed to malicious sites via QR. - Non-C-suite VIPs face 5x more attacks. - Attacks widespread in US/Europe, medical, automotive, education, energy, finance. - Use of redirects/open redirects to mask phishing. - Cloudflare Turnstile for human verification in attacks. - Pre-populated victim emails in phishing URLs. - Fake pages reject arbitrary credentials for targeting. - Bypasses legacy security via minimal text/URLs. - Shift to mobile devices lacks protections. - More than half quishing impersonates Microsoft. - Dynamic QR codes evade static scans. - QR redemption to surge to 5.3B in 2025, boosting quishing. - Macro-enabled Excel for QR generation in attacks. - Energy, finance, healthcare, education highest targeted. - SMBs especially vulnerable to quishing. - Nation-state use of QR for RAT distribution. - AI fueling advanced quishing with realistic pages. - Quishing part of 4,151% phishing rise since ChatGPT. ## The Need for Enhanced QR Code Security Measures These **statistics on QR code phishing** underscore the escalating threat of Quishing. As cybercriminals refine their tactics, staying informed and adopting proactive defense strategies becomes paramount. The rising trend of Quishing is a stark reminder of the persistent and evolving nature of cyber threats like [**voice phishing attack statistics** ](https://keepnetlabs.com/blog/vishing-statistics-unmasking-the-voice-phishing-threat)suggest. Enhanced QR code security measures like [quishing simulators](https://keepnetlabs.com/products/quishing-simulator) are advisable and essential in safeguarding against these [sophisticated phishing attacks](https://keepnetlabs.com/products/phishing-simulator). ## Protect Your Business Against QR Code Phishing Attacks with Keepnet's Quishing Simulator Keepnet's [Quishing Simulator](https://keepnetlabs.com/products/quishing-simulator), a sophisticated, cloud-based solution, is designed to evaluate and fortify your defenses against these QR phishing threats. With its extensive range of features, including 5,900+ ready-to-use templates and customizable scenarios in 60 languages, this tool is pivotal in nurturing a security-conscious culture within your organization. ### Benefits of Keepnet's Quishing Simulator - **Effective** [**Security Awareness Training**](https://keepnetlabs.com/products/security-awareness-training): Elevate your organization's defenses against QR phishing risks and reduce the likelihood of financial losses. - **Enhanced Security Framework**: Identify and mitigate risky behaviors to cultivate a robust [**security culture**](https://keepnetlabs.com/blog/how-to-build-a-strong-security-culture), effectively countering ongoing QR Code phishing threats. - **Mitigating Legal Risks and Maintaining Compliance**: Stay compliant with data protection laws to avoid substantial fines and legal complications. - **Thorough Regulatory Adherence**: Align your organization with GDPR, CCPA, and other relevant regulations. Watch our Youtube video below and see how we can protect you against QR code phishing attacks with our QR Code Phishing Simulation software. ***Editor's Note: This article was updated on March 12, 2026***. Video: ## Frequently Asked Questions ### What is the Recent Increase in QR Code Phishing Attacks? There has been a significant rise in QR code phishing attacks, with statistics showing over a 270% monthly increase. This trend highlights the growing reliance of cybercriminals on QR codes as a tool for phishing. ### What are Quishing Statistics? **Quishing statistics** refer to the data and analysis of phishing attacks that utilize QR codes to deceive victims into providing sensitive information or downloading malicious software. In recent years, these attacks have increased, with cybercriminals exploiting the convenience and popularity of QR codes. **Quishing statistics** encompass various aspects, such as the frequency of attacks, targeted industries, methods used, and the overall impact on cybersecurity. By examining QR **code phishing statistics**, organizations and individuals can better understand the threat landscape and implement effective measures to safeguard against QR code phishing attacks. ### How Prevalent Are QR Code Phishing Attacks in Different Industries? QR code phishing attacks are becoming increasingly prevalent across various industries. ### How Effective is Security Awareness Training for QR Code Phishing Attacks? Training works best when it includes practice. QR phishing simulations show employees what a malicious code looks like in an email or on a printed notice, and teach them to report it instead of scanning it. ### What is the Cost of QR Code Phishing Attacks on Businesses? Most QR code phishing aims at login credentials, so the cost follows the account that is taken over: business email compromise, data theft or fraudulent payments. Training and fast reporting limit how far a single scan can go.