QR code scams: why “just scan this” should now make you pause
QR codes are useful. That is why criminals use them. A scam QR code can hide a malicious web link, move staff onto a personal phone, and lead them to a fake login or payment page before they realise anything is wrong.
Source: Microsoft Security Blog, Email threat landscape Q1 2026.
What is a QR code scam?
A QR code scam is a phishing attack that uses a QR code instead of a normal clickable link.
The attacker creates a code that points to a fake website. That website might look like Microsoft 365, a bank payment screen, a parcel delivery page, a shared document portal, a parking payment site, or an internal IT security page.
You scan the code. Your phone opens the link. The page asks you to log in, confirm details, re-enrol multi-factor authentication, pay an invoice or update your account.
The QR code is not the danger by itself. The problem is where it sends you and what it asks you to do when you get there.
Why QR code scams can get past normal security
There are two reasons QR code scams work so well.
1. The bad link is hidden inside an image
Many email security tools are built to inspect written links. They look for suspicious URLs, known phishing domains and strange attachments.
A QR code is different. It is an image. The National Cyber Security Centre has warned that not all phishing detection tools scan images, which means QR codes can be used to disguise malicious links in emails.
Source: NCSC QR code guidance.
2. The attack moves from your work computer to your phone
Your work laptop may have endpoint protection, web filtering, DNS protection, email security and monitoring.
Your personal phone probably does not have the same protection. So when an email says “scan this QR code with your phone”, the attacker may be moving you away from the protection your business has paid for.
This does not mean every phone is unsafe. It means staff need to understand that scanning a QR code from a work email is not harmless just because it happens on a mobile.
What QR code scams look like
Most QR code scams are not dramatic. They do not look like something from a hacker film. They look boring. That is the point.
- The “security update” email.
An email appears to come from Microsoft, your IT provider or your internal IT team. It says you need to scan a code to keep your account active, re-enrol MFA, review a sign-in alert or avoid your mailbox being closed. The page asks for your Microsoft 365 password. - The shared document.
An email says a client, supplier, colleague or governor has shared a file with you. Instead of a normal link, the email includes a QR code. You scan it, land on a fake login page, and are asked to sign in before viewing the document. - The fake invoice.
A PDF invoice includes a QR code “to pay quickly”. The invoice may look convincing. It may even copy a real supplier’s branding. The QR code sends the payment to the attacker rather than the genuine company. - The delivery notice.
A message says a parcel could not be delivered and you need to scan a QR code or follow a link to rearrange delivery. The page may ask for a small redelivery fee, card details or account information. Treat unexpected delivery messages with caution, especially if they create urgency.
Source: Which? warning on quishing and dodgy QR codes. - The sticker over a real code.
A criminal prints their own QR code and sticks it over a genuine one on a parking meter, poster or payment terminal. You think you are paying for parking. You are actually handing your payment details to a stranger.
Source: Dorset Council warning about scam QR code stickers on parking machines.
How to protect your organisation from QR code scams
You do not need to ban QR codes. That would be unrealistic. You need sensible habits and a few layers of protection.
Be wary of QR codes in emails
A QR code in an email should be treated like a suspicious link. That does not mean it is always bad. But if it asks you to log in, pay, reset MFA, unlock an account or confirm personal details, stop.
Check the address before opening it
Most phones show the web address before opening a scanned QR code. Read it. If it does not look like the official website you expected, close it.
Be especially careful with lookalike domains, strange spellings, extra words, or links that use shortening services.
Go direct instead of scanning
If an email says your Microsoft account needs attention, do not use the QR code. Open your browser and go to the normal Microsoft 365 sign-in page yourself.
The same applies to banking, suppliers, HMRC, delivery companies and online services.
A good rule is simple: if the message creates pressure, do not use the link or QR code inside the message.
Watch for urgency
Scams often try to rush you. “Your account will close today.” “Payment is overdue.” “Action required within 24 hours.” “Your MFA will expire.”
That pressure is part of the trick. Real security does not normally need you to panic-scan a QR code from an email.
Use stronger MFA
Multi-factor authentication still matters. Where possible, use stronger options such as number matching, passkeys or hardware security keys.
If a password is stolen, stronger MFA can make it much harder for the attacker to use.
Check public QR codes for tampering
Before scanning a code on a parking meter, payment sign or public noticeboard, look closely. Does it look like a sticker placed over another code? Is it peeling? Does the branding look wrong?
If in doubt, use the official app or website instead.
Tell your team what this looks like
Most people have had some warning about dodgy email links. Far fewer have been warned about QR code scams.
A short staff briefing can make a big difference. Show them one example. Explain the risk. Keep it practical.
Do not make people feel stupid for scanning QR codes. We all do it. The aim is not fear. The aim is a small pause before action.
If you need practical help with this, our online scam awareness support is designed to help staff recognise the everyday scams that now affect small organisations, schools, charities and care providers.
What to do if someone scanned a suspicious QR code
If someone scanned a QR code but did not type anything into the page, the risk is usually lower. They should close the page, avoid going back to it, and tell whoever looks after IT.
If they entered a password, payment details or personal information, act quickly.
- Change the password for that account straight away.
- Change any other account that uses the same password.
- Check that multi-factor authentication is enabled.
- Ask IT to check for unusual sign-ins.
- If banking or card details were entered, contact the bank immediately.
- Watch for follow-up emails, calls or messages.
The faster you act, the less room the attacker has to move.
What businesses should put in place
QR code scams are a good reminder that cyber security should not rely on one tool.
Email filtering helps. But it will not catch everything.
A more sensible approach is layered protection. For example:
- email security that can inspect links, attachments and suspicious behaviour;
- DNS or web filtering to block known bad sites;
- endpoint protection on work devices;
- mobile protection where staff regularly use phones for work;
- Microsoft 365 security monitoring;
- multi-factor authentication;
- backup for Microsoft 365 data;
- and short, practical staff awareness training.
For businesses where staff use mobiles for work email, Microsoft 365, Teams, banking apps or authentication, Check Point Harmony Mobile can add an extra layer of protection. It includes a QR code scanner, helping users check links before they open them.
None of these controls makes you bulletproof. Together, they make it much harder for a simple scan to turn into a business problem.
Frequently asked questions
Are QR codes safe?
Most QR codes are safe. A QR code on a restaurant table, a trusted app or an official payment terminal is usually fine. The higher risk comes from QR codes in unexpected emails, texts, PDFs or public places where a code may have been covered by a sticker.
What is quishing?
Quishing means QR code phishing. It is a scam where the attacker hides a malicious web link inside a QR code. The goal is usually to steal your password, payment details or personal information.
Can antivirus or email filters stop QR code scams?
Sometimes, but not always. Some modern tools can inspect QR codes in images and attachments. Others may miss them, especially if the code is buried inside a PDF or image. That is why staff awareness and layered protection still matter.
Why is a QR code in an email risky?
A normal link can often be checked by email security before you click it. A QR code hides the link inside an image and often encourages you to scan it on a phone. That phone may not have the same protection as your work device.
What should I do if I scanned a scam QR code but did not enter anything?
Close the page and do not go back to it. The risk is usually much lower if you did not enter a password, payment details or personal information. Still, tell your IT contact so they can check whether anyone else received the same message.
Final thought
QR codes are useful. That is why criminals use them.
The safest approach is not to stop scanning every QR code. It is to slow down when a code arrives unexpectedly, especially by email or text, and especially when it asks you to log in or pay.
A QR code should make life easier. It should not be a shortcut into your business.
