Scams and phishing
QR codes are links you can't read
QR codes are everywhere: menus, parking meters, invoices, posters. You cannot see where one goes until you have already opened it.
1 min readExplainer
The short version
A QR code is just a web address in disguise. Scammers use them on stickers, letters and emails to get around link checks.
How it works
A QR code is a web address drawn as a pattern. Your phone reads it and opens the page. That is convenient, and it hides the one thing you would normally check: where the link goes.
Scammers use this in a few ways:
- Stickers placed over real codes on parking meters, restaurant tables or posters, leading to fake payment pages.
- Emails with a QR code instead of a link, asking you to “re-verify” your account. Email filters check links; a picture of a code is harder for them to read.
- Letters and invoices with a code for “easy payment.”
Scanning a code also moves the attack from your work computer, which is protected and monitored, to your phone, which often is not.
What to do
- Check the address your phone shows before opening it. If it is not the site you expected, stop.
- Do not scan a code to sign in to a work account. Go to the site the way you normally would.
- Look for stickers on public codes, especially on parking meters and payment terminals.
- Never pay through a code in an unexpected message. Use the company’s own website or app.
Talk to us about your technology
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.