Most small businesses picture phishing as a badly-spelled email with an obvious dodgy link, the kind a good spam filter catches and a careful person deletes. That version still exists, but it’s not what’s getting people in 2026. Two newer tactics — QR-code phishing (“quishing”) and MFA-fatigue attacks — are specifically built to slip past the two defenses most businesses are counting on: their email filter and their “we turned on MFA” checkbox.
Neither is exotic. Both are now commodity tactics used against ordinary small businesses, and both work precisely because they route around what you already have. Here’s how each one works, why your existing defenses miss them, and the specific settings that shut them down. No fear-mongering — just the current shape of the problem.
Phishing grew up¶
For years, the security advice was “hover over the link before you click, and check the sender.” Attackers adapted. Quishing removes the link you were told to hover over. MFA fatigue assumes you’ll do everything right, get the password stolen anyway, and then defeats the second factor by wearing you down. Both are answers to the defenses that used to work, which is exactly why they’re worth understanding.
What quishing is, and why it works¶
Quishing is phishing with a QR code instead of a clickable link. The attacker sends an email — often disguised as a “you have a new voicemail,” “review this document,” or “your MFA is expiring, rescan to re-enroll” message — with a QR code in the body. To act on it, you scan the code with your phone, which takes you to a fake login page that harvests your password.
It works for two structural reasons. First, the malicious address is hidden inside an image, so email security tools that scan for bad links, and the human trained to hover over URLs, have nothing to inspect. Second, scanning moves you onto your phone — a personal device that’s usually outside your company’s security tooling, on a small screen where the fake URL is hard to read. The attack deliberately jumps from the protected computer to the unprotected phone.
A plausible quishing scenario¶
An office manager gets an email that looks like it’s from the company’s own IT or Microsoft: “Your multi-factor authentication expires today. Scan the code below to keep your access.” It looks official, it has a logo, and it creates a small deadline. She scans the QR code with her phone out of habit, lands on a page that’s a pixel-perfect copy of the Microsoft login, and types her email and password to “re-enroll.” Nothing looks broken. The page even forwards her to the real site afterward.
What she can’t see is that her password just went to an attacker. If that’s the only thing standing between them and her mailbox, they’re in — and the most valuable version of that mailbox is one that can approve invoices or reset other people’s passwords. Notice what would have stopped it: not a filter, but a habit of never logging in from a QR code, and a login method that can’t be phished even if the password is.
What MFA fatigue is, and why “we have MFA” isn’t enough¶
Turning on MFA is one of the best things a small business can do, and it stops the majority of account attacks. But not all MFA is equal, and attackers have a specific way around the weakest common form.
The vulnerable kind is the simple push notification — the “Approve / Deny” pop-up on your phone. Here’s the attack: the criminal already has the user’s password (from a quishing page, a data breach, or reuse). They try to log in, which fires an approval prompt to the real user’s phone. The user taps deny. So the attacker tries again. And again. Ten, twenty, fifty prompts — often late at night. Eventually the exhausted or confused user taps “approve” just to make it stop, or assumes it’s a glitch. That’s MFA fatigue, and it has been behind real breaches at organizations far larger than yours. The lesson isn’t “MFA doesn’t work.” It’s “plain approve/deny push is the weak version, and you can turn on stronger settings for free.”
How to stop quishing¶
A few concrete moves shut most of it down:
- Make it a rule: never log in by scanning a QR code from an email. Legitimate services don’t make you scan a code from an email to sign in. If you need to reach a site, type the address you already know.
- Teach the specific pretext. “Your MFA is expiring, rescan to re-enroll” and “scan to view your voicemail/document” are the common lures. Naming them makes them obvious.
- Move to phishing-resistant sign-in. Passkeys and hardware security keys don’t send a password anywhere, so a fake login page has nothing to steal. This is the durable fix.
- Keep your email authentication on. DMARC, SPF, and DKIM won’t catch the QR image itself, but they cut down the spoofed “from your own IT” messages these attacks impersonate.
How to stop MFA fatigue¶
These are settings changes, mostly free, usually done once:
- Turn off simple approve/deny push and require number matching. Instead of tapping “approve,” the user has to type a number shown on the login screen into their app. An attacker who can’t see the screen can’t complete it, and blind “just tap yes” stops working. Most major platforms support this today.
- Cap and alert on repeated attempts. Lock the account or flag it after a burst of failed logins, so push-bombing trips an alarm instead of grinding the user down.
- Move high-value accounts to passkeys or hardware keys. Owners, finance staff, and admins should use the phishing-resistant kind — it can’t be push-bombed or phished at all.
- Tell staff the honest rule: an unexpected MFA prompt means someone has your password. The right response is deny, then change the password — not approve to make it stop.
A hardening checklist¶
Run your business against this. The first block stops quishing; the second stops fatigue.
Control In place?
──────────────────────────────────────────────────────────── ─────────
Staff rule: never sign in by scanning a QR code from email [ ]
Known lures named in training (MFA-expiry, voicemail, doc) [ ]
DMARC / SPF / DKIM configured on your domain [ ]
MFA number-matching enabled (no plain approve/deny push) [ ]
Repeated failed-login attempts capped and alerted [ ]
Passkeys / hardware keys for owners, finance, and admins [ ]
Staff know: unexpected MFA prompt = deny + change password [ ]
Where to start¶
If you only do two things this month: switch your MFA from plain approve/deny to number matching, and tell your team never to log in from a QR code. Those two changes, both free, close the doors these 2026 tactics rely on.
Helping small and mid-sized businesses get exactly these settings right — without a big project or a security team — is a lot of what we do. Our Cyber Essentials package includes a plain-English password and MFA policy that spells out number matching, phishing-resistant logins for key accounts, and the “unexpected prompt means deny” rule, so it’s written down and consistently followed instead of living in one careful person’s head.
If you want to know whether your current MFA can be push-bombed, or whether your team would fall for a quishing email, email support@breachsecurity.io and tell us what platform you use. We’ll tell you which settings to change first.