QR codes are part of normal business now. You scan them to see a menu, pay for parking, connect to Wi-Fi, or open a shared document.

Attackers know that. They’ve started hiding malicious links inside QR codes to get past the security tools that would normally catch a bad link in an email. The technique has a name — quishing — and it works because a QR code is just an image.

What is a QR code scam?

A QR code scam is a phishing attack that uses a QR code in place of a written link.

Instead of a clickable URL your email security can inspect, the attacker encodes the web address into a square image. You scan it with your phone, your phone opens the link, and you land on a page built to steal your login or payment details — usually a fake Microsoft 365 sign-in or a payment form copying your bank. The QR code is only the delivery method.

Why QR code scams get past your security

The link is hidden inside an image. Most email security tools scan the text of a message for known bad links. A QR code is a picture, so the link inside isn’t text the filter can read. The UK’s National Cyber Security Centre points out that not all phishing-detection tools scan images — which is exactly why criminals started using QR codes.

Scanning moves you onto your phone. Your work computer probably has web filtering, endpoint protection, and DNS controls that block known bad sites. Your personal phone usually has none of that. The moment you scan, you step outside the protection your business pays for — often without realizing it.

How common are QR code scams?

The volume is climbing fast. In its report on email threats for the first quarter of 2026, Microsoft said it detected around 8.3 billion email-based phishing threats in those three months.

QR code phishing rose 146% across the quarter, from 7.6 million attacks in January to 18.7 million in March — its highest monthly volume in at least a year. Most arrived as PDF attachments, growing from 65% of QR code attacks in January to 70% in March. The code sits inside a PDF, the PDF is attached to an email, and it looks like an ordinary document until someone scans it.

What QR code scams look like

  • A “security” email. A message that looks like it’s from Microsoft or your IT team tells you to scan a code to re-enroll MFA or keep your account active. The code leads to a fake login page.
  • A shared document. A colleague or client has “shared a file” — scan to view, then sign in.
  • A fake invoice. A PDF invoice includes a QR code “to pay faster.” The code routes your payment to the attacker.
  • A delivery notice. A text or email about a missed package asks you to scan to reschedule. The US Federal Trade Commission has warned about this exact scam.
  • A sticker in the real world. Attackers place QR stickers over legitimate ones on parking meters, posters, and payment terminals. You think you’re paying for parking; you’re handing your card to a stranger.

How to protect your business from QR code scams

  • Be suspicious of QR codes in emails. A code that arrives by email — especially one asking you to log in or pay — deserves the same caution as a strange link. The NCSC advises being wary of QR codes inside emails, even though codes at places like restaurants are usually fine.
  • Check the web address before you act. Your phone shows the link before opening it. Read it. If it isn’t the official site you expected, close it.
  • Go direct instead of scanning. If an email says your Microsoft account needs attention, type the address yourself or use a bookmark.
  • Watch for urgency. “Account closure within 24 hours” is pressure designed to rush you. That pressure is itself a warning sign.
  • Use phishing-resistant MFA. A passkey, hardware key, or number matching in an authenticator app makes a captured password much harder to use.
  • Check physical codes for tampering. Look for a sticker placed over the original before you scan.
  • Tell your team. Most people have never been warned about quishing. A short message with a real example goes a long way.

Whether your staff are in an office in downtown Laurel, a clinic in Hattiesburg, or out on job sites around Jones County, the phone in their pocket is the device quishing targets. That makes a two-minute heads-up to the whole team worth more than any single tool.

What to do if someone already scanned one

If someone scanned a QR code and entered details on the page that opened:

1. Change the password for that account right away, plus any other account using the same password.

2. Confirm multi-factor authentication is turned on for the account.

3. Tell whoever manages your IT so they can check for unusual sign-ins.

4. If card or banking details were entered, call the bank and watch the account closely.

Acting quickly limits what an attacker can do with what they captured.

How West Computers Helps Against QR Code Phishing

Most quishing aims to capture a Microsoft 365 password, so West Computers protects the account as well as the inbox. Our email security analyzes every inbound message for credential harvesting and impersonation, and sandboxes suspicious attachments before delivery. Through Microsoft 365 management, we enforce MFA and Conditional Access, and Intune lets us apply security policies to the iPhones and Android phones that reach company data. If a password does get captured, our 24/7 SOC watches for unusual Microsoft 365 sign-ins such as impossible travel, and we revoke sessions and reset credentials on a compromised account. Want to know where your gaps are? Call (601) 425-0300 or visit westcomputers.com.

Frequently asked questions

Are QR codes safe to use?
Most are. A code on a restaurant table or an official payment terminal is usually fine. The risk comes from codes in unexpected emails or texts, and stickers placed over real codes in public.

What is quishing?
Phishing that uses a QR code instead of a written link — “QR” plus “phishing.” The goal is the same: get you onto a fake page that captures your login or payment information.

Can antivirus or email filters stop QR code scams?
Not always. Many tools scan message text for bad links, and a QR code hides its link inside an image. Some products now scan images for codes, but don’t assume the scam will be caught before it reaches you.

Why is a QR code in an email more dangerous than a normal link?
A written link can be inspected by email security and opened on a managed work computer. A QR code hides the link from those tools and pushes you onto a phone with far less protection.

What if I scanned a scam QR code but didn’t enter anything?
If you closed the page without typing anything, the risk is low. Don’t go back, and let your IT contact know. If you did enter a password or payment details, follow the recovery steps above.

Article adapted with permission from The Technology Press.