> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.autophish.io/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Run a QR Code (Quishing) Simulation – by E-Mail or as Printed Posters

QR codes hide where a link really leads, and they are often scanned with a private phone that sits outside your company's security tools. With a quishing campaign, AutoPhish tests how your staff deal with QR codes – sent by e-mail, printed on posters in your offices, or both.

## Before you start

- Quishing must be included in your plan.
- QR simulations always look like **internal company communication** (for example from HR, IT, Facilities or Internal Communications), so there is no sender choice.
- QR codes sent by e-mail cost 2 credits per delivered recipient. Each printed poster location costs 10 credits once, when it is saved. See "How Credits Work – Costs, Balance and Buying More".

## Step 1 – Choose Quishing and a delivery mode

1. Click **+ New Campaign** and enter a **Campaign Name**.
2. Under **Delivery channel**, select **Quishing** (QR code simulation).
3. Under **QR delivery**, choose how the QR code reaches people:

| Mode | What happens | Target list needed |
| ---- | ---- | ---- |
| **Email only** | Each recipient gets an e-mail with a personal QR code | Yes |
| **Print only** | You place printed posters at chosen locations – no e-mail | No |
| **Email and print** | Both of the above | Yes |

4. Set the **Tone** and, for e-mail modes, the **Test Interval** and target list. Click **Next**.

![Choose Quishing and the QR delivery mode](https://storage.crisp.chat/users/helpdesk/website/-/4/3/7/4/437439cedb096800/quishing-qr-delivery_1hfbmg9.png)

The delivery mode can only be changed while the campaign is a draft. "Print only" campaigns run once and have no schedule.

## Step 2 – Select a scenario

Pick one or more QR scenarios, for example an announcement from HR, IT or Facilities. Click **Next**.

## Step 3 – Generate the QR e-mail (e-mail modes)

Click **Generate New QR Email** and review the result. The marker `[link]` shows where the QR code is placed – exactly one marker is allowed, and the e-mail must not contain clickable links. Every recipient gets their own QR code, so scans are counted accurately. The QR code in the draft preview leads nowhere.

## Step 4 – Design the posters (print modes)

In the **Print** step:

1. Edit the **Poster title** (up to 120 characters) and **Poster body** (up to 600 characters), or click **Generate New Print Copy**.
2. Under **Print Locations**, click **Add** and enter a label for each place where a poster will hang, e.g. "Lobby", "Kitchen 2nd floor" or "Canteen". You can add up to 10 locations.

Each location gets its own QR code, so you can see which poster was scanned. Locations can only be edited while the campaign is a draft.

## Step 5 – Login page and training

Choose the **Login Page** people see after scanning and decide on **Training** (see "Microtraining and Training after a Simulation"). "Skip landing page – send to training on click" is only available for "Email only".

## Step 6 – Review, launch and print

Check the **QR delivery and print kit** checklist and the cost estimate on **Review & Launch**.

- **Email only:** Click **Save and Start Campaign** (or save as draft).
- **Print modes:** Click **Start & Download Print Kit**. AutoPhish starts the campaign and downloads a PDF with a placement checklist and one A4 poster per location, in your company branding. You can download it again later with **Print Kit** on the campaign page.

Remove the checklist page before hanging the posters. Placement labels are printed by default so you can tell the printouts apart – untick **Print placement labels on posters** on the Print Kit page if you don't want them.

## What gets tracked

- **QR scans** – the main metric, split into e-mailed and printed codes.
- **Login attempts** – data entered on the landing page.
- E-mailed QR scans are counted per delivered e-mail, poster scans per location.

## Tips

- Inform facility management and reception beforehand, so they know how to respond when someone reports a poster.
- Collect the posters at the end of the campaign.
- Combine quishing with a short reminder on how to report suspicious QR codes internally.