Think Before You Scan: How QR Code Phishing Puts Your Business at Risk

Article summary: QR code phishing uses malicious QR codes to send employees to fake login or payment pages. Teaching employees to recognize suspicious codes, verify where they lead, and report mistakes quickly can reduce the risk, while stronger sign-in and device protections add another layer of security.

An email lands in an employee’s inbox warning that their Microsoft 365 password expires today. To keep their account active, they need to scan a QR code.

They pull out their phone, scan the code, and enter their password on a page that looks legitimate. It isn’t.

This is QR code phishing, or “quishing.” Because a QR code hides where it leads until someone scans it, employees may not spot the danger until it’s too late. Protecting your business starts with the right security setup and a team that knows what to look for.

Why Attackers Love QR Codes

QR codes give attackers a useful advantage: the malicious link is hidden inside an image instead of appearing as a clickable URL.

According to Keepnet’s quishing statistics, 12% of phishing attacks contained a QR code in 2025. 

The Federal Trade Commission has also warned about malicious QR codes in unexpected packages that lead to phishing sites designed to steal passwords, financial information, and other personal data.

Phones can make these attacks harder to spot.

Palo Alto Networks’ Unit 42 researchers found that attackers use redirects through legitimate websites to disguise the final phishing destination. When someone scans the code, their phone may show only the domain rather than the full URL, making a suspicious link appear more trustworthy.

Employees may also scan the code with a personal phone that has fewer security controls than a company-managed device. Unit 42 notes that this can move the victim outside protections such as corporate email gateways and web filtering, giving the phishing attempt another opportunity to reach its target.

Where Malicious QR Codes Show Up

Email and Attachments

Fake password resets, voicemail notifications, and shared-document alerts are common phishing lures. The QR code may appear directly in the email or inside a PDF attachment.

Some phishing pages even display the employee’s email address automatically, making the fake login screen look more convincing.

Printed Materials

Malicious QR codes are not limited to email. Criminals can place stickers over legitimate codes on signs, parking meters, payment terminals, and other public materials.

In 2025, the New York City Department of Transportation warned drivers after a fraudulent QR code sticker was found on a parking meter. The code directed users to a third-party website that asked for credit card information.

The same tactic can appear on flyers, signs, or other printed materials around a workplace.

Invoices and Packages

A QR code on an invoice or unexpected package may lead to a fake payment or login page. That can be especially dangerous when the person scanning it handles company finances.

Employees who pay vendors, process invoices, or approve purchases should know that an unexpected QR code deserves a closer look before they scan it.

How to Protect Your Team

Protecting your business from QR code phishing starts with a few simple habits:

• Treat an unexpected QR code like an unexpected link.
• Check the web address before opening it or entering any information.
• If a QR code unexpectedly asks you to sign in to a work account, close the page and go directly to the website or app instead.
• Verify suspicious QR codes on invoices or payment requests using contact information you already trust.
• Be especially careful with messages that create urgency, such as an overdue invoice, failed delivery, or locked account.
• Keep phones and other mobile devices updated with the latest security patches.

Technology adds another layer of protection. Phishing-resistant MFA helps prevent stolen credentials from being used on a fake login site.

Mobile device management (MDM) can enforce security settings on phones and tablets that access company data and remotely remove business data from a lost or compromised device.

If your business displays QR codes, check them regularly. Scammers can place fraudulent stickers over legitimate codes and redirect people to malicious sites.

Make QR Codes Part of Security Training

Employees may know to hover over suspicious links before clicking, but QR codes require a different habit: stop and check before scanning.

Include QR code phishing in regular security training. Show examples of fake password alerts, invoices, and payment requests, and include QR codes in phishing simulations so employees learn to recognize them.

Make reporting easy and judgment-free. Employees who are worried about getting in trouble may hesitate to speak up, while a quick report gives IT more time to respond.

What to Do If Someone Scans a Bad Code

Speed matters more than blame.

1. Report the incident to IT immediately.
2. Change the password for any account entered on the phishing page.
3. Sign out of active sessions for that account.
4. Check for suspicious sign-ins, email forwarding rules, or unusual payment requests.

Even if nothing appears wrong, report the incident. Attackers who gain access to an email account may stay quiet while they look for opportunities to steal data or money.

Knowing the quiet ways hackers get into business inboxes can help your team recognize that activity sooner.

Is Your Team Ready for QR Code Phishing?

QR code phishing takes advantage of an everyday action that feels harmless. The right security controls, employee awareness, and a simple reporting process can make these scams much easier to stop.

Unbound Digital helps businesses strengthen account security, protect company devices, and prepare employees to recognize phishing threats before they cause damage.

Contact us today to schedule a free consultation. Call 423-467-7777 or reach us online.

Article FAQs

What is QR code phishing?

QR code phishing, or “quishing”, uses a malicious QR code to send someone to a fake website designed to steal passwords, payment information, or other sensitive data.

How can you tell if a QR code is safe?

Check where the QR code leads before opening the site. Be cautious of unexpected codes, especially those that create urgency or ask you to sign in, make a payment, or provide personal information.

What should I do if I scan a malicious QR code?

Report it to IT immediately. If you entered a password, change it and sign out of active sessions. IT should also check the account for suspicious activity.