QR code scams: what businesses and staff need to know

Why scammers have turned to QR codes

Email security tools are good at checking written links, but a QR code is just an image. Many filters don't decode it, so a phishing email containing only a QR code and a short message can slip through. The scan also moves the victim from a managed work computer, with its security software and web filters, to a personal phone that often has neither. QR codes became everyday tools during the pandemic, for menus, sign-ins and payments. People learned to scan without thinking, which is exactly the habit scammers need.

The common QR scams aimed at businesses

In email, the typical message claims your multi-factor setup needs updating, a document needs signing, or your mailbox will be locked, and asks you to scan the code with your phone. The code leads to a fake Microsoft or Google sign-in page. On a phone screen, the address is harder to inspect and the page looks just like the real thing.

In the physical world, scammers stick fake QR codes over genuine ones on parking meters, EV chargers and restaurant tables, which send people to fake payment pages. Printed letters claiming to be from a regulator, courier or supplier can also carry codes. Some businesses have found fake codes stuck to their own shop windows or flyers.

QR codes also turn up in fake parking fines left on windscreens and in text messages asking you to scan a code on another screen. The format changes, but the goal is always the same: get you to a page where you hand over a password, a payment or personal details without seeing the address first.

How to scan safely

Most phone cameras show a preview of the address before opening it. Read that preview carefully, using the same rules as any link: identify the real domain and check it matches the organisation you expect. If the preview is a shortened link or a domain you don't recognise, don't open it.

If a QR code is asking you to sign in to work email, update security settings or pay something, stop and go to the official app or website directly. A genuine IT department or supplier won't mind you taking the long way round, and there's rarely a reason a sign-in must happen through a code.

Codes in emails deserve extra suspicion

There are few good reasons for a business email to contain a QR code that leads to a sign-in page. Your colleagues and suppliers can send ordinary links. A QR code in an email asking you to authenticate is, in practice, a strong sign of phishing. Teach staff to report these rather than scanning them. Some legitimate setup processes, such as adding an account to an authenticator app, do show a QR code, but these appear on your own screen while you're signed in to the real portal, not in an email from someone else.

Checking physical codes before paying

Before scanning a code to pay for parking or a service, look at the sticker. Does it sit neatly in the printed design, or is it stuck over the top? Is the edge peeling? Does the sign also name an official app you could use instead? Where an official app exists, it's the safer choice. If you've scanned a code and landed on a payment page, check the address and the business name carefully before entering card details. A page asking for more than the payment needs, such as your date of birth or online banking login, is a scam.

Protecting your business's own QR codes

If you print QR codes on menus, signs, packaging or invoices, check them now and then to make sure nobody has covered them with stickers. Use codes that point to your own domain, so customers can see in the preview that it's really you, rather than to a third-party shortener. If you include payment QR codes on invoices, tell customers how to verify them and remind them your bank details won't change by email. That helps protect them from fake invoices using your name.

Device protection for work phones

Phones that access work email and files should be managed, kept updated and protected with a screen lock. Mobile security apps and web filtering can block many known phishing sites even when a QR code is scanned. Multi-factor sign-in that uses passkeys or number matching makes stolen passwords less useful. Including QR codes in phishing awareness sessions and simulated tests helps staff recognise them. Many people who are careful with email links have never thought about where a QR code might lead.