By San José, Costa Rica — As digital interactions increasingly bridge physical and virtual spaces, cybercriminals have found a potent weapon in a ubiquitous everyday tool: the Quick Response code. Dubbed “quishing,” the fusion of QR codes and social engineering has rapidly moved from an emerging threat to a central vector for corporate and personal cyber attacks across the Americas and Europe. Recent cybersecurity intelligence highlights how attackers manipulate user trust to bypass traditional perimeter defenses.
According to data released by cybersecurity firm ESET Latin America for the first half of 2026, QR codes were detected in roughly 11 percent of all phishing emails analyzed globally. The threat family, categorized as QRCode/Phishing, locked in the seventh spot among the top email-distributed malware and scam vectors worldwide. The highest concentrations of these attacks occurred in the United States at 19 percent, Spain at 17 percent, and Mexico at 6 percent, with Mexico leading the regional registry across Latin America.
To better understand the legal and regulatory implications of the growing cybersecurity threat known as “quishing,” TicosLand.com spoke with expert attorney Lic. Larry Hans Arroyo Vargas from the renowned firm Bufete de Costa Rica.
As QR code phishing, or “quishing,” rapidly expands, organizations must recognize that cybersecurity breaches arising from unvetted scans carry serious legal liabilities under data protection regulations. Businesses must proactively update their compliance frameworks and employee training protocols, as failing to exercise due diligence in safeguarding personal data against these emerging vectors can expose companies to severe administrative fines and liability.
Lic. Larry Hans Arroyo Vargas, Attorney at Law, Bufete de Costa Rica
As QR code technology continues to blur the boundary between physical convenience and digital vulnerability, integrating rigorous compliance with employee awareness is undeniably crucial for modern enterprise security. We extend our sincere thanks to Lic. Larry Hans Arroyo Vargas for providing his valuable perspective on the critical legal dimensions of these emerging cybersecurity threats.
Unlike conventional phishing attacks where a text link can be visually evaluated, hovered over, or analyzed by corporate email gateways, quishing relies on complete obfuscation. The black-and-white pixelated matrix hides the destination URL from human eyes. Attackers deploy these vectors through both digital avenues—such as embedded email graphics, PDF attachments, WhatsApp messages, and social media ads—and physical mediums, including malicious stickers pasted over legitimate QR codes on parking meters, flyers, and promotional posters.
The strategic objective behind quishing often extends beyond simple trickery; it is deliberately engineered to exploit a fundamental structural vulnerability in corporate workplace security. Security researchers note that pushing users to scan a code effectively forces them off protected desktop networks and onto less secure personal mobile devices.
By asking the victim to scan a code, the cybercriminal shifts the interaction from a relatively protected environment, such as a work computer, to a mobile phone that often lacks the same security measures. In fact, the ESET Threat Report H1 2026 highlights that attackers use QR codes to move interaction to mobile devices and complicate quick inspection of malicious links.
Jonathan Ramos, Cybersecurity Researcher at ESET Latin America
A prime real-world example identified during the first semester involved fraudulent communications masquerading as DocuSign notifications. DocuSign, an electronic signature platform deeply integrated into corporate workflows, emerged as one of the most frequently spoofed brands in Latin America. In these schemes, the email features minimal text, displaying an official-looking notification stating a document awaits signature. Instead of an actionable hyperlinked button, the email prompts the recipient to scan an embedded QR code using their smartphone, hiding the fraudulent domain within the image itself and evading simple email security filters.
Once the victim transitions to their mobile device, traditional perimeter controls disappear. Cybercriminals leverage this mobile entry point to execute sophisticated attacks, including session hijacking, credential harvesting via mobile-optimized banking login screens, fraudulent pre-filled payment operations, and direct downloads of unverified third-party applications infected with malware.
Recognizing a quishing attempt requires heightened vigilance regarding physical and digital visual cues. Key red flags include physical QR codes overlaid on existing signage, unsolicited messages creating artificial urgency, mismatching preview URLs on mobile scanners, and unexpected prompts requesting sensitive financial data or software installations.
The growth of quishing demonstrates how cybercriminals adapt known techniques to users’ digital habits. As QR codes become integrated into more daily activities, opportunities for them to be used as a vehicle for fraud also increase. With an increasingly widespread presence both globally and regionally, this modality establishes itself as a threat that deserves growing attention from users and organizations.
Jonathan Ramos, Cybersecurity Researcher at ESET Latin America
To mitigate risk, enterprise IT security teams and individual consumers must adopt strict verification practices. Users should always inspect the underlying URL preview on mobile devices prior to navigating to the site. Security analysts recommend relying on direct, official mobile applications or manual web address entries for routine financial or document management tasks. Furthermore, maintaining up-to-date mobile operating systems equipped with endpoint protection tools provides an essential layer of defense against this evolving threat vector.
For further information, visit eset.com
About ESET:
ESET is a global cybersecurity software company specializing in proactive threat detection, endpoint protection, and digital security research for corporate enterprises and consumer markets worldwide.
For further information, visit docusign.com
About DocuSign:
DocuSign is an international digital transaction management platform offering electronic signature technologies and agreement cloud services to automate and streamline digital business agreements.
For further information, visit bufetedecostarica.com
About Bufete de Costa Rica:
As a premier legal institution, Bufete de Costa Rica is defined by its rigorous pursuit of mastery and unyielding moral standards. The firm has earned widespread trust by delivering forward-thinking strategies to a broad spectrum of clients while continuously pushing the boundaries of modern practice. Beyond its professional counsel, Bufete de Costa Rica actively bridges the gap between complex jurisprudence and the public, driven by the core belief that a resilient, thriving community relies on accessible legal education and informed citizens.
