Why Did QR-Code Phishing Surge 146% in Q1 2026 — and What Does It Mean for Unattended Payment Machines?
QR-code phishing, or “quishing”, rose 146% in Q1 2026 — from 7.6 million attacks in January to 18.7 million in March, Microsoft’s highest monthly volume in at least a year. On an unattended vending machine the attack is physical: a fraudster sticks a fake QR code over the real one, and the buyer pays a scammer, not the machine. The fix is architectural — generate the code on-screen per transaction, keep it short-lived, and let the buyer verify the merchant before scanning. A printed static code is the vulnerability.
Quishing is not an email problem.
It is a sticker problem.
The answer in one paragraph
QR-code phishing — “quishing” — rose 146% in Q1 2026, from 7.6 million attacks in January to 18.7 million in March, according to Microsoft’s threat telemetry. That was the highest monthly volume in at least a year. For an unattended vending machine, the attack is not a link in your inbox. It is a sticker on the screen. A fraudster prints a QR code that points to their own payment page and sticks it over the machine’s real code. The buyer scans it, pays the scammer, and the machine dispenses nothing. The fix is architectural, and it starts with one rule: a static printed code is the vulnerability.
The attack is physical, not digital
Email filters got better, so attackers moved to images.
A QR code is an image. A text-scanning security gateway cannot read what is inside it. Microsoft’s own Digital Defense Report flagged more than 15,000 QR-code-bearing phishing emails targeting the education sector in a single day.
That is the inbox version.
The unattended version is simpler and older: a sticker.
Municipalities have been warning about it on parking machines. In April 2026, the City of Mississauga reported fraudulent QR code stickers appearing on its Pay and Display machines. The RAC has documented the same attack on parking payment machines across the UK — a printed code stuck over the real one, redirecting payment to a fraudster.
A parking machine, an EV charger, a vending machine — same attack surface.
Nobody is standing there to catch the person who stuck the sticker.
The number that matters
The growth is not slow.
| Metric | Value | Source |
|---|---|---|
| Q1 2026 QR phishing volume (January) | 7.6 million | Microsoft Security Blog |
| Q1 2026 QR phishing volume (March) | 18.7 million | Microsoft Security Blog |
| Increase across the quarter | 146% | Microsoft Security Blog |
| February growth | +59% | Microsoft Security Blog |
| March growth | +55% | Microsoft Security Blog |
| Phishing threats analysed in Q1 2026 | 8.3 billion | Microsoft Security Blog |
Read the shape of it: a 35% decline in January, then two consecutive jumps. The direction reversed in a single quarter.
That is not a fad.
It is attackers finding a filter they can walk around.
Which payment methods survive a sticker
Not all unattended payment methods are equal under a sticker attack.
| Payment method | What the buyer touches | Survives a sticker? |
|---|---|---|
| Printed static QR code | Scans a code that could be covered | No — the primary target |
| On-screen QR generated per transaction | Scans a fresh code shown by the machine | Largely — code is short-lived and tied to the transaction |
| Contactless card / mobile wallet tap | Taps a certified terminal | Yes — tokenized, no scanning involved |
| SMS code release | Enters a one-time code | Yes — no surface to sticker |
| Prepaid account / RFID badge | Badges against the machine | Yes — no scanning involved |
The pattern is obvious.
The methods that fail are the ones where the buyer scans something a stranger could have touched.
The methods that survive are the ones where the machine generates the credential, or the credential never appears in public.
Five design rules for unattended QR payment
1. Generate the code on-screen per transaction, never print a static one.
A code that only exists for the thirty seconds of one transaction cannot be pre-stickered. A code that has been printed on the cabinet can.
2. Keep it short-lived and single-use.
The code should expire when the transaction does. A photographed code from yesterday should be dead today.
3. Show the merchant name and amount before payment confirms.
The buyer’s wallet should display who is being paid and how much. If the number is wrong, the buyer sees it before money moves.
4. Prefer the in-app flow over the web-page landing.
A wallet mini-app that opens inside the customer’s own app is a closed surface. A scanned link that lands on a browser page is an open one.
5. Offer a contactless fallback, and make the screen tamper-evident.
A contactless terminal does not ask the buyer to scan anything. A recessed or tamper-evident screen, plus remote monitoring, makes the sticker attack visible instead of silent.
The KioskForce position
We build the payment flow to specification, not to a default.
On a KioskForce machine, the QR code for WeChat Pay and Alipay is generated on-screen for the transaction — the customer’s phone does the work a reader would otherwise do. We have also built wallet mini-app front ends where the customer browses and buys inside the app, with no code to scan at all. And every machine can run an MDB cashless terminal — Nayax, Cantaloupe, VendCoin — for a tap that needs no scanning.
The design question is the same whichever way a buyer goes: what does a stranger standing at the machine get to touch?
Answer that question first, and the sticker attack falls apart.
Start with how KioskForce machines handle payment — the native QR flow, the mini-apps, and the MDB terminals — or what a custom build covers.
The number to remember
146%.
That is how fast quishing grew in one quarter.
The lesson is not “QR is dangerous.”
It is “an unattended terminal is a physical surface, and payment design has to respect that.”
Sources: Microsoft Security Blog, “Email threat landscape: Q1 2026 trends and insights” (30 April 2026); TechRadar, “QR code phishing surges 146%…” (1 May 2026); Retail Customer Experience, “The future of unattended payments depends on consumer trust” (15 October 2026); City of Mississauga, “City warns about fraudulent QR codes on parking machines” (April 2026); RAC, “RAC warns drivers about latest car park scam.” KioskForce operating facts — Nanjing design office, partner factories in Cangzhou — are stated on this site. Figures as at October 2026.
Want something like this built?
We design and manufacture custom vending machines, kiosks and the cloud software behind them. Tell us what you have in mind.
Project brief · 60 seconds
What are we building together?
Three quick steps. Your brief goes straight to the engineers who design, build and support KioskForce systems.
