QR phishing guide
QR-code phishing in email
A QR code hides a destination from ordinary link previews and moves the decision onto a phone. Treat it as a concealed link, not as proof of the sender.
Why the code changes the risk
Mail filters can inspect normal links directly. A QR code places the address inside an image and encourages the recipient to continue on another device. The phone may have fewer business protections and a smaller address bar.
Do not scan it for curiosity
The code may lead to a credential page, payment request, device-enrolment prompt or tracking URL. Investigating from your everyday phone can reveal your IP address and browser details even if you enter nothing.
Verify the requested process
Ask whether the organization normally uses a QR code for this exact action. Reach the account through the known app or website. A real invoice, parking notice or document request should have an independent record that agrees with the email.
What to preserve
Keep the original message, surrounding text and embedded image. The image hash can connect repeated copies, while the email source records the sender path. A trained analyst can decode the image in a controlled environment without visiting the destination.
If you scanned the code
Close the page. If you entered credentials, change them from a trusted device and review sessions and recovery settings. If the code installed a profile or app, remove network access and have the device checked before using it for sensitive work.
Action checklist
- Treat the QR image as a link whose destination is hidden.
- Use the camera preview to read the domain without opening it.
- Reach the claimed account through its official app instead.
Questions people ask
Is viewing a QR code dangerous?
Viewing the image is generally different from scanning and visiting its destination. Do not scan it merely to investigate.
Can a QR code contain more than a website?
Yes. It can encode text, contact details, Wi-Fi settings or an application link, which is why the requested action matters.