Articles on: Campaigns

Run a QR Code (Quishing) Simulation – by E-Mail or as Printed Posters

QR codes hide where a link really leads, and they are often scanned with a private phone that sits outside your company's security tools. With a quishing campaign, AutoPhish tests how your staff deal with QR codes – sent by e-mail, printed on posters in your offices, or both.


Before you start


  • Quishing must be included in your plan.
  • QR simulations always look like internal company communication (for example from HR, IT, Facilities or Internal Communications), so there is no sender choice.
  • QR codes sent by e-mail cost 2 credits per delivered recipient. Each printed poster location costs 10 credits once, when it is saved. See "How Credits Work – Costs, Balance and Buying More".


Step 1 – Choose Quishing and a delivery mode


  1. Click + New Campaign and enter a Campaign Name.
  2. Under Delivery channel, select Quishing (QR code simulation).
  3. Under QR delivery, choose how the QR code reaches people:


Mode

What happens

Target list needed

Email only

Each recipient gets an e-mail with a personal QR code

Yes

Print only

You place printed posters at chosen locations – no e-mail

No

Email and print

Both of the above

Yes


  1. Set the Tone and, for e-mail modes, the Test Interval and target list. Click Next.


Choose Quishing and the QR delivery mode


The delivery mode can only be changed while the campaign is a draft. "Print only" campaigns run once and have no schedule.


Step 2 – Select a scenario


Pick one or more QR scenarios, for example an announcement from HR, IT or Facilities. Click Next.


Step 3 – Generate the QR e-mail (e-mail modes)


Click Generate New QR Email and review the result. The marker [link] shows where the QR code is placed – exactly one marker is allowed, and the e-mail must not contain clickable links. Every recipient gets their own QR code, so scans are counted accurately. The QR code in the draft preview leads nowhere.


Step 4 – Design the posters (print modes)


In the Print step:


  1. Edit the Poster title (up to 120 characters) and Poster body (up to 600 characters), or click Generate New Print Copy.
  2. Under Print Locations, click Add and enter a label for each place where a poster will hang, e.g. "Lobby", "Kitchen 2nd floor" or "Canteen". You can add up to 10 locations.


Each location gets its own QR code, so you can see which poster was scanned. Locations can only be edited while the campaign is a draft.


Step 5 – Login page and training


Choose the Login Page people see after scanning and decide on Training (see "Microtraining and Training after a Simulation"). "Skip landing page – send to training on click" is only available for "Email only".


Step 6 – Review, launch and print


Check the QR delivery and print kit checklist and the cost estimate on Review & Launch.


  • Email only: Click Save and Start Campaign (or save as draft).
  • Print modes: Click Start & Download Print Kit. AutoPhish starts the campaign and downloads a PDF with a placement checklist and one A4 poster per location, in your company branding. You can download it again later with Print Kit on the campaign page.


Remove the checklist page before hanging the posters. Placement labels are printed by default so you can tell the printouts apart – untick Print placement labels on posters on the Print Kit page if you don't want them.


What gets tracked


  • QR scans – the main metric, split into e-mailed and printed codes.
  • Login attempts – data entered on the landing page.
  • E-mailed QR scans are counted per delivered e-mail, poster scans per location.


Tips


  • Inform facility management and reception beforehand, so they know how to respond when someone reports a poster.
  • Collect the posters at the end of the campaign.
  • Combine quishing with a short reminder on how to report suspicious QR codes internally.

Updated on: 27/10/2026

Was this article helpful?

Share your feedback

Cancel

Thank you!