QR Code Phishing

    Scan With Suspicion

    QR codes in emails, documents or posters can hide sign-in pages or payment requests. Inspect before acting.

    Everyday Cyber SafetyEveryday usersFinanceLeadership

    Illustrative scenario

    How It Looks in Real Life

    A PDF attached to an email says your MFA must be renewed and shows a QR code. Scanning it opens a page on your phone that looks like your company sign-in.

    Understand it

    How the Attack Works

    A QR code hides its destination until scanned, and phones show less of the address. Attackers use this to move victims from a protected work computer to a personal phone with fewer security controls.

    Red flags

    Warning Signs

    • QR codes in emails or documents asking you to sign in, pay or “re-verify” an account.
    • Stickers placed over existing QR codes on parking meters, menus or posters.
    • A preview address that does not match the organisation you expected.

    Safer habits

    What to Do Instead

    • 1Read the previewed address before opening it; if unsure, do not open.
    • 2Sign in by opening the official app or typing the known address yourself.
    • 3Confirm account or payment requests through a known channel.

    Response playbook

    Already Interacted?

    For work accounts and devices, report promptly through your organisation’s IT or security process first. Never share passwords, codes or tokens in a report.

    If you: opened a message or clicked a link
    1. 1Close the page without entering anything further.
    2. 2Report the message through your usual IT or security reporting channel.
    3. 3Keep the original message; do not forward it to colleagues as a warning.
    If you: entered credentials or shared a code
    1. 1Report it to IT or security immediately for a work account; speed matters more than embarrassment.
    2. 2Change the password from a trusted device by typing the real address yourself.
    3. 3Sign out of all sessions from the account security settings. A password change alone may not end active sessions.
    4. 4Review recovery email, phone number and forwarding rules for unexpected changes.
    If you: sent a payment or changed bank details
    1. 1Contact your bank immediately and ask for a recall of the transfer.
    2. 2Inform finance leadership and IT or security the same day.
    3. 3Keep all emails, invoices and call records as evidence.

    Knowledge Check

    What Would You Do?

    An email titled “Payroll update” asks you to scan a QR code to keep receiving your salary. What is safest?

    Fictional example for learning. Not a test score or certification.

    Sources

    Content reviewed by WazuGuardix on 5 October 2026. Summaries are in our own words.

    All Awareness Guides

    Make Safe Habits Part of Your Culture

    Plain-language awareness sessions for everyday staff, developers and business teams.

    Email Us