QR Code Scams: What They Are and How to Protect Your Business
A QR code is just a link in a form people cannot read. That is what makes it useful on a menu or a poster, and also what makes QR code scams possible. You cannot tell where a QR code goes by looking at it, and many people scan without thinking.
What a QR code scam is
QR code phishing, often called quishing, uses a QR code to send someone to a fake website. The page might imitate a Microsoft 365 sign-in, a bank, a parking payment page or a package delivery tracker. The goal is to collect passwords, payment details or to push a download.
The FBI has warned that criminals tamper with QR codes, both in digital images and on physical stickers placed over real codes, to send people to sites that steal sign-in details and financial information.
Why they get past your protection
Email filters look for suspicious links and attachments in the text of a message. A QR code is often an image, so the link inside is not visible to a basic filter. The email may look harmless: a short message and a picture.
The second problem is the device. Someone who sees a QR code in an email on their computer will pick up their phone to scan it. The phone is usually outside your company’s protection and has fewer warnings than a computer. The attack has moved from a managed device to a personal one.
What QR code scams look like
- Email “security” notices. A message says your multi-factor authentication or password needs to be updated, and asks you to scan a code to continue.
- Fake invoices and documents. An email says you have a shared document or a payment waiting, with a code to open it.
- Stickers over real codes. A fraudulent code placed on a parking meter, a charging station, a table menu or a poster.
- Mailed letters and flyers that look official and ask you to scan.
- Texts and messages pointing to a code to “verify” a delivery.
How to protect your business
- Teach one rule. Do not scan a QR code that arrived by email or text, especially one that asks you to sign in or pay. If a message seems real, go to the company’s website by typing the address or using a bookmark.
- Look at the address before you open it. Most phone cameras show the web address before they open it. If it looks odd, is shortened, or does not match the company, do not continue.
- Be careful with signs and stickers in public. Check whether a code looks like it was stuck on top of another one, and prefer apps or websites you already trust for payment.
- Use strong sign-in protection. Multi-factor authentication and passkeys reduce the damage if a password is stolen. Passkeys cannot be handed to a fake page. See what passkeys are.
- Choose email protection that handles images, and ask your provider whether it checks QR codes. No filter is perfect, so awareness still matters.
- Check your own QR codes. If your business posts codes on menus, signs or flyers, inspect them regularly to be sure nobody has covered or replaced them.
- Put work apps on managed phones where you can, so that staff phones have updates and protection.
Our post on spotting scam emails that look real covers the other warning signs, and our cybersecurity services cover email protection and helping your team recognize scams.
What to do if someone already scanned one
Do not panic, and do not blame the person. The sooner it is reported the more can be done.
- If they only opened the page and entered nothing, close it. Risk is low, but tell your IT provider.
- If they entered a password, change it right away from a different device, and tell your IT provider so sessions can be revoked and the account checked.
- If they entered payment information, contact the bank or card issuer immediately.
- If they downloaded something, stop using the device and ask your IT provider to check it.
- Report it to the FBI’s Internet Crime Complaint Center at ic3.gov if money or data was lost.
Frequently asked questions
Are QR codes safe to use?
The codes themselves are harmless. The risk is where they lead. Treat a QR code as you would a link from an unknown sender: check where it goes before you act.
What is quishing?
Quishing is phishing that uses a QR code to hide the link to a fake site. It is used in emails, texts, mailed letters and stickers on signs.
Can antivirus or email filters stop QR code scams?
Some can, but many filters read links in text, not in images, so QR codes can slip through. A good filter, trained staff and strong sign-in protection work better together than any one alone.
Why is a QR code in an email more dangerous than a normal link?
You cannot read it, and scanning it with a phone moves the risk to a device that is probably outside your company’s protections. That is why the rule is not to scan codes that arrive by email.
What should I do if I scanned a scam QR code but did not enter anything?
Close the page and tell your IT provider so they can check. If you did enter anything, change the affected passwords from another device and report it right away.
