QR Code Scams: What They Are and How to Protect Your Business

QR codes feel ordinary now. People use them for parking, menus, payments, event check-ins and shared documents.

That familiarity is exactly why criminals use them.

A QR code can hide a link to a fake Microsoft 365 sign-in page, payment form or malware download. Because the link is stored in an image rather than displayed as text, it can be harder for a person and some security tools to inspect before it opens.

The Australian Signals Directorate calls this type of phishing “quishing”. The goal is the same as any other phishing attack: rush someone onto a convincing page and get them to enter a password, payment detail or other sensitive information.

Why a QR code changes the attack

With a normal email link, the recipient may be able to hover over it and inspect the destination. The email security service can also analyse the written address.

A QR code removes that visibility. The person sees a square image and has to scan it before learning where it leads.

Scanning usually moves the interaction from a managed work computer to a mobile phone. That phone may not have the same web filtering, endpoint protection or business monitoring as the computer.

Microsoft Threat Intelligence reported that QR-code phishing volume rose from 7.6 million attacks in January 2026 to 18.7 million in March, a 146 per cent increase over the quarter. Most were delivered in PDF attachments.

The number is useful because it shows the technique is not a novelty. Attackers are using it at scale.

What a QR-code phishing email looks like

Common messages use a familiar business task:

• scan to keep your Microsoft 365 account active
• scan to reset multi-factor authentication
• scan to open a shared document
• scan to hear a voicemail
• scan to view or pay an invoice
• scan to confirm a delivery

The message often creates urgency. It may threaten account closure, a missed payment or an expired security setting.

The QR code may sit inside a PDF, making the attachment look like an ordinary document. It may also use the logo and colours of Microsoft, a bank, a delivery company or another trusted organisation.

The image is not proof of who sent it. Neither is the display name at the top of the message.

Physical QR codes can be replaced

Quishing is not limited to email.

A criminal can place a sticker over a legitimate code on a parking meter, payment terminal, poster or venue table. The replacement may lead to a fake payment page that copies the real service.

Before scanning a public code, check whether it looks like a sticker has been placed over the original. If the payment matters, use the official app or type the service address yourself.

This is especially relevant around busy Northern Beaches retail and parking areas where people are used to scanning quickly and moving on. The safer habit takes only a few seconds.

Check the destination before opening it

Most phone cameras display a preview of the destination before opening it. Read that preview.

Look for misspellings, unexpected domains, shortened links or an address that has nothing to do with the organisation named in the message.

Do not treat the padlock symbol as proof that the site is legitimate. It only means the connection to that site is encrypted. A scam site can also use encryption.

If the message says a Microsoft account needs attention, open the Microsoft 365 portal from a bookmark or type the known address. If the claimed issue is real, it should be visible after signing in directly.

The same rule works for a bank, delivery company or government service. Go through the official app or a saved address rather than the QR code.

Passwords are not the only target

Many QR-code scams lead to fake sign-in pages. The attacker may capture the password and the multi-factor authentication approval.

Some modern phishing kits can proxy the real sign-in process and steal a session token, which is the digital proof that the account has already signed in. This can defeat weaker forms of multi-factor authentication.

Phishing-resistant authentication, such as a passkey or hardware security key, is stronger because it checks the real website during sign-in. It cannot be tricked into authenticating to a lookalike domain in the same way.

QR codes can also lead to payment fraud, malicious apps or requests to link a new device. Staff should treat any code asking for credentials, payment or software installation as a high-risk request.

Train for the behaviour, not the buzzword

Staff do not need to remember the word quishing. They need to recognise the behaviour:

• an unexpected code arrives by email or message
• it creates urgency
• it asks for a login, payment or security action
• it moves the task onto a phone
• the destination is difficult to inspect

A short real example is more useful than a long annual awareness video. Show the team a fake Microsoft sign-in QR code and explain the safer action: open Microsoft 365 directly.

Make reporting easy. A person who scans a suspicious code should know who to contact without worrying that they will be blamed.

What to do after scanning

If someone scanned a suspicious code but did not enter information or install anything, close the page and report the message. The IT team can check the destination and remove similar messages.

If a password was entered, report it immediately. From a known-clean device, the response may include changing the password, revoking active sessions, checking authentication methods and reviewing sign-in activity.

If a multi-factor prompt was approved or a device was linked, say so. That changes the response.

If card or bank details were entered, call the financial institution using a trusted number and monitor the account. Do not wait to see whether a transaction appears.

If an app was installed, stop using the device and get it checked.

Add technical controls as well

Awareness is one layer. Microsoft Defender for Office 365 and other modern email-security tools can inspect images and detect QR-code phishing patterns, but no filter catches every message.

Managed devices can also use web filtering and browser protection to block known malicious sites. Extending those controls to work mobile devices reduces the gap attackers are trying to exploit.

Conditional Access, which applies rules to Microsoft 365 sign-ins, can limit risky locations, devices and authentication methods. These settings form part of cybersecurity support rather than being isolated products.

The safest response is often not to scan

An unexpected QR code asking for a work login should be treated like an unexpected link.

Pause, inspect the destination and go to the claimed service directly. Use a passkey where available, verify payment requests through a separate channel and report suspicious messages quickly.

Vaelis IT helps Northern Beaches businesses set up Microsoft 365, protected devices and practical security habits that work together. If QR-code phishing is reaching your team, we can review the filtering, sign-in controls and response process without over-engineering it.