Do not scan an unexpected QR code to fix an account, view a document, receive a voicemail, or avoid a service interruption. It can hide the destination and move the attack onto your phone.
Why criminals use QR codes
Email filters can inspect ordinary links. A QR code turns the destination into an image and encourages you to continue on a personal phone where corporate protections may not apply.
Common stories
Watch for QR codes claiming to activate MFA, prevent Microsoft 365 expiration, release a quarantined email, retrieve a secure document, pay an invoice, or listen to voicemail.
What to do instead
- Open the named service directly from its official app or a saved bookmark.
- Ask IT whether the request was expected.
- Never enter a work password after scanning an unsolicited code.
- If you already signed in, report it immediately—speed matters.
This page provides general security guidance, not a guarantee that any individual message is safe. When money, passwords, remote access, or sensitive records are involved, verify through a separate trusted channel.