QR codes can be just as dangerous as suspicious links.

When most people think of phishing, they picture suspicious email attachments or fake links. What many people don’t realize is that a QR code is simply another way to hide a web link. Scanning a QR code can take you to the same malicious websites that attackers would normally send through email.

In some cases, QR codes can be even more dangerous. Because you’re usually scanning them on a mobile device, it’s often harder to inspect the destination before opening it. Modern phishing websites are designed to look nearly identical to Microsoft 365, Google, banks, shipping companies, and other trusted services. Their goal is simple: convince you to enter your password, payment information, or other sensitive data.

While today’s smartphones include built-in security features, they are not immune to attack. A malicious website can still attempt to steal your credentials, trick you into downloading harmful files, or exploit vulnerabilities in outdated software. That’s why it’s important to only scan QR codes from trusted sources and always think before you scan.

Six Warning Signs of QR Code Phishing

1. Unexpected QR Codes

Not every QR code is malicious, but an unexpected QR code should always make you pause. Attackers often include QR codes in emails, text messages, invoices, and even printed flyers because many people assume they’re safer than links.

Before scanning, ask yourself:

• Was I expecting this?
• Does this request make sense?
• Why is a QR code being used instead of a normal website?

Legitimate organizations typically direct you to their official website rather than asking you to scan a QR code for sensitive information. If something feels unusual, verify the request through another trusted method before scanning.

2. Website Doesn’t Match

A QR code is simply a shortcut to a website. Before your phone opens it, most modern smartphones display a preview of the web address. Take a few seconds to actually read it.

Watch for:

• Misspelled company names
• Extra words or numbers
• Strange web addresses
• A website that doesn’t match the company you expected

For example, if an email claims to be from Microsoft, the QR code shouldn’t send you somewhere unrelated. If the destination doesn’t look right, don’t continue.

3. Fake Login Pages

One of the most common QR code scams is a fake login page. The page may look exactly like Microsoft 365, Google, Paycom, or another trusted service.

Ask yourself:

“Why am I signing in?”

If you’re scanning a QR code to view a document, pay a bill, or check a package delivery, you usually shouldn’t have to sign in first. Attackers rely on familiar logos and realistic-looking pages to trick people into entering their usernames and passwords.

Instead of signing in, close the page and visit the company’s official website yourself.

4. File Downloads

Scanning a QR code shouldn’t immediately download a file, app, or software update just to display information.

If a download starts automatically:

• Do not open the file.
• Delete it immediately.
• Contact the IT Help Desk if it came from a work-related message.

Malicious files can contain malware designed to steal information or compromise your device. When in doubt, let IT verify the file before opening it.

5. Account Alerts

Scammers know that people react quickly when they think something is wrong with their account.

Messages like:

• “Your account has been locked.”
• “Password expired.”
• “Mailbox full.”
• “Verify your account immediately.”

are designed to create urgency.

Before scanning a QR code, stop and think. Would Microsoft really ask you to unlock your account by scanning a QR code? In most cases, legitimate companies direct you to their official website—not through an unexpected QR code in an email or text message.

6. Payment Requests

QR code payment scams are becoming increasingly common.

Scammers may claim you owe:

• A shipping fee
• An unpaid invoice
• A subscription renewal
• A toll payment
• A utility bill

The QR code takes you to a fake payment page that steals your credit card information or asks you to sign in before paying.

If you weren’t expecting the payment, don’t scan the QR code. Instead, visit the company’s official website or call them using a trusted phone number to verify the request.

If you entered your Microsoft password or payment information on a suspicious website, change your password immediately and notify the IT Help Desk.

If the answer to any of these questions gives you pause, don’t continue until you’ve verified the request.

Think You May Have Been Phished?

If you scanned a suspicious QR code, entered your password on an unfamiliar website, or begin receiving unusual login prompts or suspicious emails afterward, change your password immediately. A password reset is one of the quickest ways to protect your account if your credentials may have been compromised.

On a Windows computer, press Ctrl + Alt + Delete and choose Change a Password to update your password. If you need assistance or aren’t sure whether your account was affected, submit a ticket through the WSOC Support Portal at support.wsoc.me. The IT Help Desk would rather investigate a false alarm than have a compromised account go unreported.

Taking a few extra seconds to think before scanning a QR code can prevent stolen passwords, financial loss, and unauthorized access to your account. When in doubt, don’t scan, verify first.