What Is Quishing? How QR Code Scams Target Oregon Businesses

QR codes have quietly become part of daily business life across Lane County. They show up on parking meters, restaurant tables, shipping labels, event flyers, and invoices. Scanning one feels harmless, almost automatic. That reflex is exactly what a growing category of scams depends on. Security officials, including the FBI, warned early in 2026 about the rise of QR code phishing, sometimes called quishing. For business leaders in Eugene and Springfield, this is not a reason to panic, but it is a reason to pay attention, because the risk reaches the same places every other cyber threat does. It touches your accounts, your data, and the trust your clients place in you.

What quishing actually is

Quishing is phishing that uses a QR code instead of a clickable link. The idea is the same as a fraudulent email. Get someone to visit a fake page and enter a password, a payment detail, or a login approval. The delivery is what changed. A code can be printed on a letter, pasted over a legitimate sticker in a parking lot, attached to a fake invoice, or embedded in an email as an image. When an employee scans it, they are taken to a site that looks real but exists to steal information. Because the code is just a pattern of squares, a person cannot read the destination the way they might read a suspicious web address. They have to trust it, and trust is the opening.

Why a QR code slips past your defenses

The clever part of quishing is where it sends the victim. Scanning usually happens on a personal phone, which moves the activity off the company computer and away from the filters and protections a business has in place. Email security tools that scan links often treat an image of a QR code as just an image. The phone may not have the same protections as an office laptop. In a single motion, the attacker has moved the interaction to a device the business does not manage and cannot see. That is why a threat that looks low tech can be surprisingly effective, and why it deserves the same seriousness as any emailed link.

The business consequences of one scan

It is easy to think of a scanned code as a personal mistake rather than a business problem, but the two are connected. Many employees use the same phone for work email, Microsoft 365, and messaging. If a fake page captures a work login or convinces someone to approve a sign-in, the attacker can reach company systems from there. The outcomes are familiar. Exposed email and files, redirected payments, access to client records, and in the worst cases a foothold for broader attacks. For regulated fields such as healthcare, legal, and accounting, that exposure can carry reporting duties and compliance consequences. For any business, it can mean downtime, financial loss, and an uncomfortable explanation to customers about how their information was handled.

Why the timing makes this worse

Two ordinary realities make quishing more effective right now. First, work has gone mobile. Field crews, hybrid staff, and busy front-desk teams rely on phones throughout the day, and scanning a code is second nature. Second, QR codes carry a sense of legitimacy because they are everywhere and usually harmless. That everyday familiarity lowers people’s guard at the exact moment attention would help. Add convincing design, and a fake notice asking staff to scan a code to re-verify an account or view an invoice can look entirely routine.

Building simple habits that hold up

Defending against quishing is less about technology and more about a few clear habits that leadership can set and reinforce. Treat an unexpected QR code the way you would treat an unexpected link, with healthy caution and a pause. If a code arrives in an email or a letter asking someone to log in, verify the request through a known channel before scanning, such as calling the vendor or checking directly with a coworker. Be especially wary of codes that create urgency, promise access, or ask for credentials or payment. Physical codes deserve a look too, since a sticker placed over a real one is a known trick. These habits cost nothing and are easy to practice, but they only take hold when a business makes them part of how it works rather than a one-time reminder.

Where technology and guidance help

Habits are the front line, but they are stronger with support behind them. Mobile device management can bring some order to the phones that touch company data, separating work from personal use and adding protection where it is missing. Email filtering and monitoring can catch many attempts before they reach an inbox. Ongoing awareness training keeps staff current as tactics change, which they will. Most small organizations do not have the time to keep up with each new twist, and they do not need to carry that alone. That is where a managed IT and cybersecurity partner earns its keep, by handling the quiet, continuous work of protection so leaders can focus on running the business.

A steady next step

Quishing is a reminder that attackers will always look for the path with the least resistance, and right now that path can be a printed square of squares. The response is not fear, but awareness and a little structure. At Emerald Technology Group, we help Eugene and Springfield organizations put practical protections in place, from mobile device oversight and email security to staff guidance that reflects how attacks actually arrive today. If your team scans codes as part of the workday, a short conversation about verification habits and device protection is a sensible move. We are here to help you take it, and to make sure a convenient tool does not turn into an open door.