Updated 23 August 2026 — this article was rewritten with primary sources added and unsupported claims removed.
A QR code in a phishing email is not a clever way to hide a link. It is a way to move you onto a different computer. The mail filter that would have caught the link never sees it, because the link is a picture; and the phone you finish the login on is not the machine your employer secured. Microsoft Threat Intelligence recorded the shift precisely: QR-code phishing volumes climbed from 7.6 million in January 2026 to 18.7 million in March, a 146% rise in a quarter, against roughly 8.3 billion email-based phishing threats overall (Microsoft Security). Defending against it means changing one habit, not buying anything.
Before you change anything, understand what the code actually does
Text-based scanning engines read text. A QR code is an image, so the malicious URL inside it is not there to be read — Microsoft’s Q1 2026 analysis describes attackers embedding URLs in images specifically to “exploit the limitations of text-based scanning engines and redirect victims to phishing sites on unmanaged mobile devices”. Two protections fail at once. The gateway does not resolve the destination, and the device that opens it has none of your organisation’s controls on it: no managed browser, no enterprise DNS filtering, often no way for anyone to see what happened.
This is why look at the URL before you tap is necessary but not sufficient. By the time the URL is on screen you have already crossed to the unmonitored device. The step that matters happens earlier.
The rule that does the work
Treat a QR code as a navigation shortcut and never as an authentication step. Scanning a code to read a menu, open a schedule or load a product page is fine — nothing is at stake. The moment a scanned page asks you to sign in, approve an MFA prompt, enter a card number or install something, stop and reach that service the way you normally would: your own bookmark, your own app, a number from your own records.
The Federal Trade Commission’s guidance lands in the same place, warning people not to scan a code in an unexpected message and to “use a phone number or website you know is real to contact the company” instead (Federal Trade Commission). That single substitution — arriving under your own steam rather than theirs — removes the attacker’s control over where you land, which is the only thing the QR code bought them.
The checklist
Each of these is a thing to do, not a posture to adopt. Work down it once and most of it stays done.
- Turn off automatic opening. In your camera app, disable any setting that follows a scanned link without showing you the URL first. On iOS this is Settings → Camera → Scan QR Codes; on Android it varies by camera app. You want the URL shown as a preview you must tap.
- Expand the preview before tapping. Shortened and redirector domains hide the real destination. If the preview shows a link shortener rather than the organisation’s own domain, do not open it.
- Never sign in on a page you reached by scanning. Close it, open your own bookmark or app, and sign in there. If the request was genuine it will be waiting for you.
- Refuse permission prompts that follow a scan. The FBI’s advice on QR-code fraud is to “take precautions before authorizing phone permissions and access to websites and applications” (FBI Internet Crime Complaint Center). A menu does not need your contacts.
- Check physical codes for a sticker. On parking meters, payment terminals and posters, run a fingernail over the code — the FTC documented scammers pasting their own codes over legitimate ones. A raised edge means someone added it.
- Treat a code on an unexpected parcel as hostile. The FBI has warned about unsolicited packages that arrive with no sender information precisely to tempt the recipient into scanning (FBI cyber alert). Bin the code, keep the parcel if you like.
- Move MFA to a phishing-resistant method. A passkey or hardware security key is bound to the real domain, so it will not release a credential to a lookalike page even if you do everything else wrong. This is the only item here that protects you when the habit fails.
If you already scanned one
Nothing is lost if you did not enter anything. If you did sign in, change that password from a different device and revoke active sessions in the account’s security settings, in that order — changing the password alone can leave an attacker’s session alive. Approve no further MFA prompts, since a stolen password often turns into a stream of push requests hoping you tap one out of irritation. On a work account, tell whoever handles security even if you think you caught it; they can see whether a session was created and you cannot.
The structural move here — crossing a boundary the defender cannot police — recurs elsewhere. Identity-based access control narrows it, because granting access to named services rather than to a whole network limits what a stolen session reaches. The same pattern drives prompt injection against AI agents, where the system cannot tell instructions it was given from instructions it merely read.
Where this still gets people
The habit fails under time pressure, which is the entire design of the lure. A code that arrives with a deadline attached — a parcel that will be returned, an account that will be closed, a payment that will fail — exists to stop you doing any of the above. Targeted campaigns are not limited to broad consumer fraud either: the FBI and CISA issued a joint advisory in January 2026 on North Korea-linked Kimsuky actors using malicious QR codes against US organisations (FBI/CISA joint advisory), so the same pivot is being used deliberately against people who have something worth taking.
The useful mental shift is small. A QR code can take you somewhere. It should never be the reason you prove who you are.
