A QR Code Can't Fail a DMARC Check, Which Is Exactly Why Scammers Love It

Here's the uncomfortable part: every spam filter, every header check, every bit of email authentication you lean on to catch a fake was built to read text. A link is text. A sender domain is text. A QR code is a picture. And a picture of a square cannot fail a check that doesn't know how to look at it.

That gap is the whole business model behind the thing security people now call "quishing" — QR-code phishing. The FTC put out a consumer alert about it in late 2023, flagging exactly the scenarios that keep working: a QR sticker slapped over the real one on a parking meter, an email claiming a package couldn't be delivered, a message warning that your account needs "reactivation." Scan here. That's the ask every time.

Walk through why it beats the defenses you already have. When a normal phishing email arrives, your provider runs it through a stack of authentication — SPF checks whether the sending server is allowed to send for that domain, DKIM checks whether the message was signed and untampered, and DMARC ties those together and tells the receiver what to do when they fail. A link to paypaI-secure-login dot com sitting in the body of a message is also text a filter can read, compare against known-bad lists, and flag. The system has something to grab onto.

Now put that malicious link inside a QR code embedded as an image. SPF, DKIM, and DMARC still run — and the email can pass all three, because a crook who controls a throwaway but properly configured domain can send a technically legitimate, fully authenticated message. The authentication is doing its job. It's just answering a question that no longer matters, because the dangerous part isn't the sender. It's the image the sender is asking you to point your phone at.

And your phone is the second half of the trick. You don't scan a QR code on your laptop, where you've got a password manager that refuses to autofill on the wrong domain and a big screen showing the full URL. You scan it on a phone, where the address bar truncates, where the mobile browser hides the tells, and where you're usually standing in a parking lot already annoyed about a ticket. The UK's National Cyber Security Centre makes this point plainly in its quishing guidance: the code moves the attack onto the device with the worst defenses and the most distracted user.

So the line of defense moves back to you, which nobody wants to hear. But the moves are boring and they work. A legitimate parking notice, bank, or delivery company does not route you through a QR code in an email to log in or pay. If a message creates urgency and hands you a square to scan, that combination is the tell. Don't scan from the email — go to the company's site or app directly, the way you normally would. On a physical sign, check whether the QR sticker is literally a sticker peeling up over the printed one underneath. And treat any page that asks for a password or card number after a scan as guilty until proven innocent.

The authentication stack isn't broken here. It's just that we spent fifteen years teaching machines to read email, and the scammers responded by sending a message no machine needs to read — only a human with a phone and a bad morning. The square doesn't lie to the filter. It skips the filter entirely and talks to you.