QR codes have become a normal part of doing business.
People scan them to view menus, pay for parking, connect to Wi-Fi, open shared documents, and complete payments.
Attackers know how comfortable people have become with QR codes, and they have started using them to hide malicious links from security tools that would normally detect a suspicious URL inside an email.
This technique is called quishing.
It works because a QR code is an image. Many email filters are designed to inspect written text and clickable links, so a malicious web address hidden inside a QR code may pass through without being detected.
When the recipient scans the code, they usually do so with a mobile phone. That phone may sit outside many of the protections installed on the employee’s work computer.
This post explains what QR code scams are, why they can bypass traditional security controls, what common attacks look like, and which habits can help protect your business.
What is a QR code scam?
A QR code scam is a phishing attack that uses a QR code instead of a written or clickable link.
Rather than placing a URL directly in the message where email security can inspect it, the attacker encodes the web address inside a square image.
The recipient scans the code with a mobile phone, the phone opens the link, and the user arrives at a website designed to steal login credentials, payment information, or other sensitive details.
The website on the other end is usually the same type of fake page used in a traditional phishing attack. It may imitate a Microsoft 365 login screen, reproduce a bank’s payment page, or copy the appearance of another trusted service.
The QR code is simply the delivery method used to get the victim there.
Why QR code scams get past your security
Two factors make QR code scams especially effective.
First, the malicious link is hidden inside an image.
Many email security tools scan message text for known malicious links and suspicious web addresses. A QR code is a picture, so the URL encoded inside it may not appear as readable text to the filter.
The United Kingdom’s National Cyber Security Centre notes that not every phishing-detection system scans images. That gap is one reason criminals began using QR codes to disguise malicious links.
Second, scanning the code moves the user onto a mobile phone.
A company-managed computer may have web filtering, endpoint security, DNS protection, and other controls designed to block known malicious websites.
A personal mobile phone may not have any of those protections.
The moment an employee scans the code, they may leave the protected environment the business pays for without realizing it.
How common are QR code scams?
The number of QR code phishing attacks is increasing quickly.
In its report on email threats during the first quarter of 2026, Microsoft stated that it detected approximately 8.3 billion email-based phishing threats over those three months.
QR code phishing increased by 146% during the quarter, rising from 7.6 million attacks in January to 18.7 million in March.
By the end of the quarter, QR code phishing had reached its highest monthly volume in at least a year.
Microsoft also found that most of these attacks were delivered through PDF attachments.
PDFs accounted for approximately 65% of QR code attacks in January and 70% by March.
The attacker places the QR code inside a PDF, attaches the file to an email, and presents it as an ordinary invoice, shared document, security notice, or account alert.
The attachment may appear harmless until someone scans the code.
What QR code scams look like
These are some of the QR code scams businesses encounter most frequently:
- A “security” email. You receive a message that appears to come from Microsoft or your IT provider. It instructs you to scan a QR code to re-enroll in multifactor authentication, verify your identity, or prevent your account from being disabled. The code leads to a fake login page.
- A shared document. An email claims that a colleague, vendor, or client has shared a file with you. To view it, you are told to scan a QR code and sign in. The login page is controlled by the attacker.
- A fake invoice. A PDF invoice includes a QR code that promises a faster or easier payment method. Scanning it directs the payment to the attacker rather than the legitimate company.
- A delivery notice. A text message or email says you missed a package and must scan a code to reschedule delivery or pay a small fee. The United States Federal Trade Commission has warned consumers about this type of scam.
- A physical sticker. Attackers print their own QR code stickers and place them over legitimate codes on parking meters, posters, restaurant signs, or payment terminals. The victim believes they are paying for a real service but instead sends card information to a criminal.
How to protect your business from QR code scams
Protecting your organization from quishing depends on a combination of security controls and practical habits.
- Be cautious with QR codes received by email. A code that arrives in an email, especially one asking you to log in, verify an account, or make a payment, deserves the same suspicion as an unexpected written link. The National Cyber Security Centre recommends caution when scanning QR codes in emails, even though codes in trusted physical settings may be routine.
- Check the web address before continuing. Most phones display the destination link before opening it. Read the full address carefully. If it is misspelled, unfamiliar, or different from the official site you expected, close it.
- Go directly to the website instead of scanning. If an email says your Microsoft 365 account, bank account, or delivery requires attention, open the official application or type the known website address into your browser yourself.
- Watch for urgency. Messages that threaten account closure, fines, missed deliveries, or service interruptions within a short period are designed to rush you. Urgency is often a warning sign.
- Use phishing-resistant MFA. If a scam captures a password, phishing-resistant authentication can make the stolen credential harder to use. Options include passkeys, hardware security keys, Windows Hello for Business, and appropriately configured authenticator applications.
- Inspect physical QR codes for tampering. Before scanning a code on a parking meter, sign, poster, or payment terminal, check whether a sticker has been placed over the original code.
- Warn your employees. Many people have received phishing training but have never been specifically warned about malicious QR codes. Share a short explanation and a realistic example so employees understand what to look for.
What to do if someone already scanned one
If you or someone on your team scanned a QR code and entered information on the page that opened, act immediately:
- Change the password. Update the password for the affected account immediately. Change any other account that uses the same or a similar password.
- Confirm MFA is enabled. Make sure multifactor authentication is turned on and review the available authentication methods for anything unfamiliar.
- Contact your IT provider. Ask whoever manages your technology to check for unusual sign-ins, suspicious inbox rules, unknown devices, and other signs that the account has been accessed.
- Contact your bank when necessary. If card numbers, banking details, or payment information were entered, contact the financial institution and monitor the account closely.
Acting quickly can limit what an attacker is able to do with the information they captured.
Article used with permission from The Technology Press.