> For the complete documentation index, see [llms.txt](https://herd-security.gitbook.io/herd-security-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://herd-security.gitbook.io/herd-security-docs/simulations/phishing-simulations/qr-code-phishing.md).

# QR Code Phishing

Add a scannable QR code to your phishing email templates to test how your team responds to quishing, phishing that moves the attack onto a mobile device.

## Overview of QR Code Phishing

QR code phishing (sometimes called *quishing*) hides the malicious link inside a scannable QR code instead of a clickable link. Because recipients usually scan the code with their phone, the attack often moves off the protected corporate device and onto a personal one, making it a blind spot for many teams.

In Herd, QR codes aren't a separate template type. Instead, you add a QR code directly to an email phishing template using the `{{QR_CODE}}` placeholder. When the campaign sends, Herd renders a unique QR code for each recipient and embeds it in the email. The QR code *is* the tracking link, so a scan is tracked just like a click; no separate link is required.

QR code phishing is ideal when you need to:

* Test whether employees scan **unverified QR codes** in emails.
* Simulate attacks that **bypass desktop protections** by moving to mobile.
* Add variety to your simulations beyond standard clickable links.

{% hint style="info" %}
QR code support is currently marked **Beta** in the template editor. The QR options panel appears once you add the `{{QR_CODE}}` placeholder to your email body.
{% endhint %}

***

## Adding a QR Code to a Template

QR codes are configured inside the email template editor. If you haven't built a template yet, see [**Creating Email Templates**](/herd-security-docs/simulations/phishing-simulations/creating-email-templates.md) first.

**Step 1: Insert the QR placeholder**\
In the **Email Body**, click **Insert {{QR\_CODE}}** to drop the `{{QR_CODE}}` placeholder where you want the QR code to appear. You can also type the placeholder by hand.

When the placeholder is present, the body status indicator shows **{{QR\_CODE}} included** and notes that the **QR acts as link**. Because a scanned QR code is itself a tracked link, a template with a QR code doesn't also need `$LINK` or `{{TRACKING_URL}}`, though you can still include a clickable link if you want both.

**Step 2: Adjust the QR code options (optional)**\
Once `{{QR_CODE}}` is in the body, a **QR code options** panel appears. All fields are optional; leave them blank to use Herd's defaults:

* **Width (px, 100–1000)**: the size of the rendered QR code image. Default: 200.
* **Error correction**: how much of the code can be damaged and still scan. Choose from *L (\~7% recovery)*, *M (\~15% recovery)*, *Q (\~25% recovery)*, or *H (\~30% recovery)*. Default: M.
* **Foreground color (hex)**: the color of the QR modules. Default: `#000000`.
* **Background color (hex)**: the color behind the modules. Default: `#ffffff`.

**Step 3: Check the preview**\
A live **QR code preview** updates as you change the options, so you can see how the code will look. The preview encodes a sample URL; at send time each recipient receives a unique tracking QR pointing at their own link.

**Step 4: Save the template**\
Click **Create template** (or **Save changes**) to finalize the template, then use it in a campaign. The template page's details rail confirms **QR code acts as the link** and **Includes a QR code**.

***

## Launching a QR Code Campaign

A QR code template is launched exactly like any other email template, through a campaign. See [**Create Campaign**](/herd-security-docs/simulations/phishing-simulations/create-campaign.md) for the full flow:

1. On the **Campaigns** tab, click **New campaign**.
2. Enter a **Name**, choose **Pick from library**, and tick your QR code template (or point the campaign at a collection or tag that contains it).
3. Pick **One time** or **Ongoing** and click **Create**.
4. On the campaign's **Audience** tab, add your recipients and choose whether to send now or schedule.
5. Click **Send to N** (or **Schedule campaign**).

When the campaign sends, Herd generates a fresh QR code for each recipient that encodes their personal tracking URL, then embeds it inline in the email. There's nothing extra to configure on the campaign itself; the QR behavior comes from the template you selected.

***

## Reviewing QR Code Results

QR scans are tracked alongside opens and clicks on the campaign's **Results** tab. When a recipient scans the QR code and lands on the tracking URL, Herd records it and shows a **Scanned QR** outcome for that person, distinct from the **Clicked** outcome, so you can tell scanned-QR engagement apart from a normal link click. The **Scanned QR** chip above the results table filters to just those people.

Opening a person's row shows their **Phishing history**, where the scan appears as **Scanned the QR code** with its timestamp, alongside **Opened**, **Submitted credentials**, and **Reported** events. A scan that arrives very soon after delivery is briefly held while Herd confirms it wasn't an email security scanner; it shows as **QR scan pending confirmation** until it settles. See [Campaign Results](/herd-security-docs/simulations/phishing-simulations/campaign-results.md#how-herd-tells-people-from-scanners) for details.

These results feed into the same campaign metrics and reporting as your other simulations, so QR-based engagement is measured right alongside the rest of your phishing program.