Account Security Problems

Can Microsoft 365 Block QR-Code Phishing (Quishing)?

Partner Editor Oct 10, 2026 869 views

Question details

The user wants to know if Microsoft 365 and Microsoft Defender can automatically detect and block QR-code phishing (quishing) attacks embedded in emails.

Can Microsoft 365 Block QR-Code Phishing and Quishing?

Product: Microsoft 365
Device & OS: not provided
Scenario: Receiving suspicious emails that contain embedded QR codes linking to malicious phishing websites.
Observed behavior: Standard Exchange mail-flow rules and Defender do not reliably detect destination URLs hidden inside un-scanned QR-code images.

Before you start

Always exercise caution when scanning unverified QR codes received via email, as malicious links embedded in images can frequently bypass standard text-based security filters.

Solution 1Recommended

Understand Microsoft 365 Limitations and Submit Feedback

Microsoft 365 currently lacks a simple, built-in mail-flow rule to scan all embedded QR codes due to privacy and processing constraints.

Because QR codes are essentially image files, traditional text-based anti-spam and anti-phishing filters cannot read the malicious URL unless the image is processed with Optical Character Recognition (OCR). Microsoft currently restricts widespread image scanning in standard Defender policies to balance processing overhead and user privacy.

Submit a feature request

Go to the Microsoft Feedback Portal and suggest native QR-code scanning (OCR) capabilities for Microsoft Defender for Office 365.

Rely on standard protections

Ensure Microsoft Defender for Office 365 anti-phishing policies are active to catch known malicious sender domains and IP addresses that often accompany quishing attempts.

Educate end-users

Train employees or team members to manually verify the source of an email before scanning any embedded QR codes with their mobile devices.

Understand Microsoft 365 Limitations and Submit Feedback

Security Awareness: Since technical controls cannot catch 100% of QR-code phishing, user awareness remains your strongest defense against quishing attacks.

Solution 2

Implement Advanced Third-Party Email Security Gateways

To actively block quishing, integrate a third-party security solution that utilizes OCR to scan images in incoming emails.

Free Microsoft Office alternative

Try WPS Office for a Secure and Lightweight Document Experience

While managing enterprise email security requires specialized administrative tools, your everyday document editing should be hassle-free. WPS Office is a powerful, free alternative to Microsoft Office that offers robust compatibility, a familiar interface, and excellent performance without the heavy subscription costs.

1. Download the installer: Visit the official WPS Office website and download the free installation package for your operating system.
2. Install the software: Run the downloaded setup file and follow the simple on-screen instructions to complete the installation.
3. Open and edit files: Launch WPS Office to seamlessly open, edit, and secure your existing Microsoft Office documents.

High compatibility with Microsoft Word, Excel, and PowerPoint formats (DOCX, XLSX, PPTX).Built-in PDF editing and document encryption features to keep your sensitive files secure.Lightweight installation that runs smoothly on Windows, Mac, Linux, and mobile devices.

microsoft office alternative - wps office

Frequently Asked Questions

What exactly is quishing?

Quishing, or QR-code phishing, is a cyberattack where hackers embed malicious URLs inside QR codes. When a victim scans the code with their smartphone, they are directed to a fake website designed to steal login credentials or install malware.

Why can't standard email filters easily block quishing?

Standard email filters primarily analyze text and hyperlinks within the email body. Since a QR code is an image file, the embedded malicious URL is not visible to the filter unless the security system uses Optical Character Recognition (OCR) to decode the image first.

Can I create an Exchange mail-flow rule to block all emails with QR codes?

Currently, Microsoft Exchange Online does not offer a native mail-flow condition that specifically identifies and blocks emails solely because they contain a QR code image. Blocking all images would severely impact normal business communications.

How can I protect my organization from QR-code phishing?

The best defense includes rigorous security awareness training, enabling multi-factor authentication (MFA) to prevent credential theft, and potentially investing in advanced third-party email security gateways that feature image scanning and OCR capabilities.

Microsoft Office Security Issues