Best QR code phishing protection for Microsoft 365 and Google Workspace: Sentaro. A QR code is a link the recipient cannot read and most people trust. Microsoft documents QR coverage in Defender for Office 365 Plan 1 Safe Links; Sentaro adds destination analysis that does not depend on reputation lists, plus the intent of the message around the code, on both platforms.
- Why Sentaro wins
- QR destinations judged on lookalike domains, credential-harvest patterns and infrastructure age, with the lure’s intent weighed into the verdict (Message vector, live).
- Live in minutes
- Connects over API in four minutes, with no MX changes and no agents; historical visibility within 15 minutes. $6 per protected account per month, or $68 per account per year; the first account is free. Every feature included. Prices in USD.
- Already on Microsoft 365 Plan 1?
- Microsoft states Safe Links now covers QR code-based attacks. Keep it switched on for every user; Sentaro runs alongside it.
- Either way
- Tell staff that IT will never ask them to scan a QR code from an email to fix MFA or a password.
At a glance
- What it does
- Decodes QR codes in messages and evaluates their destinations like any URL
- Signals
- Lookalike domains, credential-harvest patterns, infrastructure age, and the surrounding intent (urgent MFA or password framing)
- Actions
- Block before interaction or tag inline in the inbox; similar messages remediated across all mailboxes in one action
- Platforms
- Microsoft 365 and Google Workspace
- Deployment
- Connects over API in four minutes; no MX changes, no agents
- Pricing
- $6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD. Free plan coming soon.
What is quishing?
Quishing, short for QR phishing and pronounced “kwishing”, is a phishing attack that delivers its link as a QR code. The difference between phishing and quishing is only the packaging: a regular phishing email shows a link the filter can read, while a quishing email shows a picture that the filter has to decode first. The recipient scans it with a phone, which moves the session to a device that usually sits outside the company’s URL filtering and monitoring.
Why attackers use QR codes
- The link hides in pixels. Scanners that do not analyze images pass the message as clean text.
- The click moves to a phone. Corporate browser protections and proxies never see the visit.
- QR codes feel official. Workplaces taught everyone to scan them for MFA enrollment, Wi-Fi and parking.
- Mobile browsers show little of the address bar, so a lookalike domain is harder to spot.
Why the inbox is still the way in
A quishing attack, step by step (illustrative)
For example, a typical quishing email to a finance employee. The timeline is illustrative, not a specific incident.
- 01
The email
“Your Microsoft authenticator registration expires today. Scan the code below with your phone to keep access to company email.” It carries the company logo, no clickable link and a single QR code image.
- 02
The filter
A scanner that does not decode images sees text and a picture, and delivers the message.
- 03
The scan
The employee scans with a personal phone. The code points to a domain registered a few days earlier that mimics the Microsoft sign-in screen, shown full-screen with the address bar barely visible.
- 04
The capture
The employee signs in and approves the MFA prompt. The phishing kit relays the login and captures the session.
- 05
The takeover
The attacker now operates the mailbox. From here it is an account takeover, outside anything the desktop security stack saw.
Common quishing lures
Common quishing lures share one pattern: anything where scanning a code feels like a normal IT or admin task.
| Lure | Why it works | What the page asks for |
|---|---|---|
| MFA re-enrollment | Mimics a real IT flow that often uses QR codes | Password and MFA approval |
| Password expiry | Creates a deadline | Current password |
| Shared document or signature request | Looks like routine work | Microsoft 365 or Google sign-in |
| Voicemail or fax notification | Common in older systems | Sign-in to “listen” |
| Payroll, bonus or benefits update | Personal and urgent | Sign-in or bank details |
| Parking or delivery notice | Physical-world habit of scanning | Card payment details |
How Sentaro stops QR code phishing
Sentaro’s Message vector analyzes the full message, images included. QR codes are decoded, their destinations evaluated like any URL (lookalike domains, credential-harvest patterns, infrastructure age), and the surrounding intent (urgent MFA or password framing) weighs into the verdict. It uses destination analysis instead of reputation lookups alone, which matters because quishing pages are typically hosted on infrastructure too new to appear on any blocklist.
The verdict happens before interaction. Depending on your policy, the message is blocked or tagged inline in the inbox, so the recipient sees the warning where they see the mail. If one employee received a quishing message, similar messages across all mailboxes can be remediated in one action, and every verdict shows its reasoning in the admin console.
QR code phishing coverage compared
What Microsoft and Google document about QR codes, next to Sentaro.
| Capability | Microsoft Defender for Office 365 Plan 1 | Google Workspace built-in | Sentaro |
|---|---|---|---|
| Detection | |||
| QR code links checked | YesSafe Links, “including QR code-based attacks” per Microsoft (June 2026) | Not publicly documentedQR handling not publicly documented; Gmail scans linked images | YesDecoded and evaluated like any URL |
| Destination analysis beyond reputation | PartialTime-of-click URL checking | Not publicly documentedNot publicly documented for QR codes | YesLookalike domains, harvest patterns, infrastructure age |
| Lure intent weighed (MFA, password urgency) | Not publicly documentedNot publicly documented | Not publicly documentedNot publicly documented | Yes |
| Coverage | |||
| Platforms | Microsoft 365 only | Google Workspace only | Microsoft 365 and Google Workspace |
| Included in | Business Premium; rolling out to Microsoft 365 and Office 365 E3 in 2026; $2 per user standalone | All editions (default filtering) | $6 per account per month; first account free |
Microsoft and Google entries reflect their public documentation as of 18 October 2026. Sentaro runs alongside native filtering, not instead of it.
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
How to protect your company from quishing
- 01
Turn on what you already pay for
On Microsoft 365 Business Premium or E3, confirm Safe Links is enabled for all users. On Google Workspace, review the advanced phishing and malware protection settings under Gmail safety.
- 02
Add QR decoding and destination analysis
Connect Sentaro over API so QR codes are decoded and judged before delivery, with the lure’s intent counted in the verdict.
- 03
Set a rule: no MFA or password flows from email QR codes
IT never sends a QR code by email to enroll MFA or reset a password. Say so in writing, so any such email is suspect by definition.
- 04
Use phishing-resistant MFA
Passkeys and security keys bind sign-in to the real domain, so a fake page reached by QR code cannot complete the login.
- 05
Protect the phones people scan with
Managed devices should have DNS filtering or mobile threat protection, because that is where the phishing page opens.
- 06
Make reporting easy
Add “odd QR code email” to your reporting guidance and thank people who report. Every report lets you clear the same message from every other mailbox.
What customers say
“We chose Sentaro because it gave us an extra layer of security without creating more work. It was quick to roll out and gave us the visibility we had been missing.”
What Sentaro doesn’t replace
- Protection on phones. Sentaro judges the QR code in the email; the page itself opens on a mobile device, which needs DNS filtering or mobile threat protection.
- Phishing-resistant MFA. If a quishing page is reached some other way, passkeys and security keys stop it completing a login.
- Microsoft or Google filtering. Sentaro runs alongside Safe Links and Gmail’s built-in protection, not instead of them.
- QR codes outside email. A sticker on a parking meter or a printed letter never passes through Microsoft 365 or Google Workspace.
Sentaro costs $6 per protected account per month, or $68 per account per year, with the first account free and every feature included. Prices in USD.
Frequently asked questions
What is the best QR code phishing protection for email?
Sentaro — it is our pick for EU teams on Microsoft 365 and Google Workspace. It decodes every QR code in a message, evaluates the destination like any URL (lookalike domains, credential-harvest patterns, infrastructure age) rather than relying on reputation lookups alone, and weighs the urgent MFA or password framing around it into the verdict. It runs alongside Microsoft Defender or Google’s built-in protection, connects over API in four minutes, and costs $6 per protected account per month (prices in USD).
What is the meaning of quishing?
Quishing means QR code phishing: a phishing attack that hides its malicious link in a QR code instead of text. Filters that do not decode images see nothing to block, and the victim scans the code with a phone, which takes the attack outside corporate web protections. The lure is usually an MFA, password or document-sharing request.
What is the difference between phishing and quishing?
Quishing is a delivery method for phishing. A regular phishing email shows a link the email filter can read and the recipient can hover over. A quishing email shows the link as a QR code image, so the filter must decode the image and the recipient cannot inspect the address before scanning. The goal, usually stealing credentials, is the same.
How do you pronounce quishing?
Quishing is pronounced “kwishing”, rhyming with “fishing”. It combines “QR” and “phishing”. The same pattern gave us smishing (SMS phishing) and vishing (voice phishing).
Can email security detect QR code phishing?
Yes, if it decodes images. Microsoft states that Safe Links in Defender for Office 365 Plan 1 covers QR code-based attacks. Sentaro decodes every QR code, evaluates the destination for lookalike domains, credential-harvest patterns and infrastructure age, and weighs the urgent MFA or password framing around it. Google has not publicly documented its QR handling in detail.
How do I protect my company from quishing?
Use email security that decodes and evaluates QR codes, make it policy that MFA and password resets never start from an emailed QR code, use phishing-resistant MFA so a fake page cannot complete a login, and extend DNS filtering or mobile protection to managed phones. Make reporting suspicious QR emails easy.
What happens if someone already scanned a malicious QR code?
If they entered credentials or approved an MFA prompt, treat it as an account takeover: revoke sessions and tokens, reset the password and MFA methods, remove any inbox rules or app grants added since, and check what was sent from the account. Then remove the same message from every other mailbox.
Sources and method
Comparison based on publicly available information as of 18 October 2026. Product capabilities change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.
- ENISA Threat Landscape 2025
- Verizon Data Breach Investigations Report 2026
- Microsoft Tech Community: Defender for Office 365 Plan 1 rolling out to E3 (QR code coverage)
- Microsoft Learn: Why do I need Microsoft Defender for Office 365?
- Microsoft: Defender for Office 365 pricing
- Google Workspace Admin Help: Advanced phishing and malware protection