In this guide 10 sections
At a glance
The short version.
Watch for
- A code in an unexpected email, calendar invitation, document or parcel
- A warning that an account, subscription, delivery or payment expires immediately
- Instructions to scan with a personal phone to bypass a work computer
Already acted?
Close the page and do not approve any login or security prompt.
See every recovery stepWhat is changing now
The current pattern.
QR phishing—sometimes called quishing—is now used alongside adversary-in-the-middle login pages that can capture passwords and active session information. Official alerts also describe QR codes arriving in unsolicited physical packages, not only emails and posters.
How it works
How the scam unfolds.
A QR code converts a destination into an image. That convenience hides the full address until after a phone has interpreted the code, making it harder to notice a misspelled domain or unrelated service.
The code may appear in a renewal notice, parking sign, parcel, invoice, shared document or calendar invitation. It can lead to a copied sign-in page, a payment request or instructions to install software. More advanced phishing pages relay a real login flow while stealing credentials or session information.
A code printed on professional stationery or placed on a familiar object is not automatically trusted. Stickers can be replaced, email accounts can be compromised and reputable cloud services can host misleading content.
Warning signs
Reasons to stop and verify.
- A code in an unexpected email, calendar invitation, document or parcel
- A warning that an account, subscription, delivery or payment expires immediately
- Instructions to scan with a personal phone to bypass a work computer
- A sign-in request after scanning when you were already signed in
- A payment page whose domain does not exactly match the organisation
- A sticker placed over another code or a code with no clear owner and purpose
Spot the signs
What it can look like.
Highlighted phrases are warning signs; the numbered notes explain each one.
IT Service Desk <it-servicedesk@secure-docs-portal.example1 (warning sign 1)>
Action required: shared document expires in 10 minutes2 (warning sign 2)
Hi, a document titled ‘Q3 budget revisions’ has been shared with you.
Due to new security rules, this file can only be opened on a mobile device.3 (warning sign 3) Scan the code below with your phone and sign in with your work account to view it.
If the document is not opened, it will be deleted automatically.
IT Service Desk
- A sender outside your organisation
The message claims to come from internal IT but uses a domain that is not your employer’s. Display names are easy to fake; the part after @ matters.
- An artificial deadline
Shared documents do not normally expire within minutes. The deadline is there to stop you asking IT first.
- A reason to switch devices
Moving the sign-in to a personal phone can take you outside the filters and warnings that protect a work computer.
- A destination you cannot read
The code hides the web address until after you scan. A sign-in page reached this way can capture your password and any code you enter.
If a document really has been shared with you, it will be waiting in the app or site you normally use. Open that yourself instead of scanning.
Composite example: names, numbers and “.example” addresses are fictional.
Worked example
A realistic pattern, separated into evidence.
This composite example is educational. It does not describe a real person or reproduce a live malicious message.
A security notice moves the login onto a phone
- 01The opening
An email that appears to come from a workplace service says a document cannot be opened until the recipient scans a QR code. The message uses the company logo and names a real internal project.
- 02The escalation
The QR code opens a mobile sign-in page that looks familiar and requests an email address, password and approval code. A countdown says the document will expire in ten minutes.
- 03The decision point
The code deliberately hides the destination and moves the login away from the device where mail security tools may be active. The unexpected second login and deadline are stronger signals than the quality of the page design.
Independent verification
Test the request without using its evidence.
These checks deliberately move the decision away from the person, link, number or account that introduced the request.
- 01
Identify the expected service
Ask what legitimate account or transaction the code supposedly relates to. Open that service through its established app or bookmark without scanning.
- 02
Read the registrable domain
If a destination preview is available, identify the actual domain that controls the page—not a familiar brand word placed in a subdomain or URL path.
- 03
Check the physical context
For a public code, look for a replacement sticker, damaged sign or conflicting payment instructions. Contact the venue or operator through a separately found channel.
- 04
Refuse a surprise sign-in
A QR code that unexpectedly leads to credentials, payment, a download or a security-setting change should be closed until the request is independently confirmed.
Prevention
Make the next attempt harder.
- 01
Use official apps for regular services
Install or bookmark the apps and sites you use for parking, deliveries and work documents, so you never need a printed or emailed code to reach them.
- 02
Make the preview a habit
Use a camera or scanner that shows the destination before opening it, and read the domain every time — not only when something feels wrong.
- 03
Upgrade your sign-in
Where available, use passkeys or a security key for email and work accounts. They are designed not to work on look-alike sites, which blunts copied sign-in pages.
- 04
Learn how your workplace shares files
Know which tools your employer uses to share documents and how IT will contact you. A message that breaks that pattern is easier to spot and report.
If you already acted
Protect access and contact the real provider.
- Close the page and do not approve any login or security prompt.
- Change a submitted password through the real service and sign out other sessions.
- Contact your bank if card or account information was entered, even if no payment completed.
- Remove an unfamiliar app and seek trusted technical help if software was installed.
- Preserve the code’s location or original message without scanning it again, then report it to the organisation being impersonated.
Common questions
Short answers to real doubts.
Is it safe to scan a QR code if my phone shows a preview of the link?
A preview helps only if you read it properly. Find the registrable domain — the name just before the ending, such as .com or .co.uk — rather than a familiar word elsewhere in the address. If the code leads to a sign-in, payment or download you did not expect, close it and go to the service directly.
Practise reading web addressesCan scanning a QR code infect my phone by itself?
Scanning usually just opens a web address, an app or a pre-filled action. Most of the harm comes from what happens next: entering a password, making a payment, installing an app or approving a prompt. Keeping your phone and browser updated reduces the rarer risk from malicious pages themselves.
What about QR codes on parking meters or restaurant tables?
Check the physical code before scanning. Look for a sticker placed over another code, damage, or a code that does not match the operator’s signs. Where you can, pay through the operator’s official app or the machine itself, and report tampered codes to the venue or operator.
Sources
Official guidance used for this article.
Stop & Verify summarises these sources for general education. Reporting routes and legal protections vary by location.