Mexico is the QRishing hotspot of Latin America: how to stop fake QR codes from stealing payments and passwords at your Mexico operation

On October 6, 2026, Mexican media reported that Mexico is the epicenter of QRishing in Latin America, as Edomex Al Día put it. QRishing is phishing with QR codes: instead of a strange link in an email, someone puts a small square in front of you, you scan it with your phone and land on a fake page.

If you run a plant, warehouse or store in Mexico from abroad, this hits two places: the counter where you get paid and the inbox where the passwords live. Here is where it shows up, why your global controls miss it and what to ask your local team to do.

Where fake QR codes show up at a Mexico site

No hacking required. Sometimes a sticker and one unattended minute at the counter are enough.

Where	What it looks like	What they take
Payment QR at a store or branch	Sticker placed over the real code	The customer payment
Invoices and emails	“Scan to reactivate your Microsoft 365”	Username and password
Parking lots	QR on a post to “pay the fee”	Card details
Menus and cafeterias	Menu QR swapped for another	Data or a malicious app

The one we see most in offices is the email. A PDF arrives that looks like an invoice or an IT notice, with a QR code and “your account expires today”. Someone in accounting scans it with their phone, types the password, and now a stranger is in that mailbox.

Why QR codes slip past email filters and endpoint security

Email filters inspect links. A QR code is an image, and many filters do not read it as a link.

The bigger problem: the code opens on a phone, not on the company laptop. A personal phone has none of your endpoint protection, does not go through the site firewall, and its small screen hides the full web address. In our experience, global security policies cover laptops well and local phones barely at all.

Payments and collections: dual approval

That same week, Mexican press covered how fraud is slowing digital payments among small businesses, and bank customers claimed 11,213 million pesos in fraud losses in the first half of 2026, according to Carta de México.

Four habits for your local finance and store staff:

• Check printed payment QR codes every morning. Run a fingernail over them: a sticker on top is easy to feel.
• Where the bank or terminal allows it, use a QR generated per sale instead of a fixed printed one.
• Any change to a supplier bank account gets confirmed by phone, at a number you already had.
• Payments above a set amount: one person enters them, another approves.

Our take: dual approval is boring, and that is exactly why it works.

Anti-QRishing checklist for your Mexico operation

Two quick terms. Phishing-resistant MFA means a second factor such as passkeys or a hardware key, which will not work on a fake site. A DNS filter blocks bad domains at the point where names become addresses, so the fake page never loads.

Measure	What it solves	Where it applies
Staff training in Spanish	Nobody types a password after scanning a QR	Everyone, starting with admin and finance
Physical QR checks	Catches stickers over real codes	Stores, branches, front desk
Phishing-resistant MFA	A stolen password is no longer enough	Email and online banking
DNS filtering	Blocks the fake site even if the QR opens	Site Wi-Fi and company phones
Dual payment approval	Two people to move money	Treasury and collections

For the passkey side, see how to protect Microsoft 365 email from passkey phishing.

Plants and branches: the phones nobody manages

A plant in Querétaro or a warehouse in Nuevo León has QR codes everywhere: the cafeteria, the parking lot, supplier notices. Local managers often use their own phones for work email.

Corporate mobile management (MDM, a tool to manage company phones remotely) closes that gap: DNS filtering on every device, work apps kept separate, and a remote wipe if the phone is lost. It also helps to have local people who can verify who is really asking for access.

Let’s talk

What about your Mexico operation?

If your site takes payments, handles collections or reads email on phones, QRishing already applies to you.

ProcessBi IT support plans include anti-phishing training in Spanish, email and DNS protection, and corporate phone management, with invoicing in MXN or USD. We start with a free assessment.

Book your free assessment — we reply the same business day.