2 October 2026

QR code scams: how to spot them and protect your business

A QR code does not tell you where it leads. That is the whole point — and the whole problem. With a link, at least you can read the address before clicking. With a QR code, you point your phone and trust.

Scammers have understood this very well. According to Microsoft's figures, the QR-code attacks it detected went from 7.6 million in January to 18.7 million in March 2026. And this year's Barracuda malicious-email report says that 70% of the malicious PDFs it analysed hid a QR code leading to a fake page.

Why now, and what AI has to do with it

A few years ago, building a fake login page that looked like the bank's or Microsoft 365's took time and skill. Now, with AI, it takes minutes, and the accompanying email arrives in flawless language without a single mistake to give it away.

The QR code adds two advantages for the scammer. First, it is an image, and many mail filters do not read it as a link. Second, you scan it with your phone — outside the company computer and whatever protections are installed there.

The two ways in

1. The QR code that reaches you. An email or a PDF saying "scan to view the outstanding invoice", "renew your email password before today", "your parcel is on hold" or "you have an official notification". It can also come on paper, by post, or stuck to the door.

2. The QR code you put up yourself. The restaurant menu, the payment code at the counter, the "leave us a review" in the window. Someone sticks their own QR code on top, and your customers end up on a fake site. You did nothing wrong, but the scam carries your name.

An example: the café with QR codes on the tables

Take a café with its menu on a QR code at every table. One Monday, three customers complain: scanning the code, a window asked them to "confirm" something and now they have a paid subscription they never requested. They check the tables and find four with a sticker placed over the original code. Someone had done it over the weekend.

They lost no money, but they lost trust: one bad review and customers who no longer scan anything. Now the codes are printed inside the laminated holder, the address is written underneath, and whoever opens up checks them every morning.

Warning signs

• An email or PDF asks you to scan a QR code instead of clicking a link. A serious company has no reason to do that.
• There is hurry: "expires today", "final notice", "avoid the surcharge".
• After scanning, the page asks for a password, card details, or to install an app.
• The address the camera shows is not the official domain, is shortened, or has swapped letters (an "l" for an "I", an extra hyphen).
• On paper or a sign: a crooked sticker, lifted edges, or a QR code stuck over another one.

The 30-second checks

• Read the address preview before opening it. Most phones show one.
• If it is a service you already know (the bank, the company mail, the tax office), do not scan: go there yourself, via the app or by typing the address.
• Never enter a password on a page you reached through a QR code.
• If an email is in doubt, phone whoever supposedly sent it, on a number you already have — not the one in the message.

If the QR codes are yours

• Make them point to your own domain, and print the address in text underneath so the customer can compare.
• Check them every day when you open. Ten seconds, as long as it becomes a routine.
• Integrate them into the design or laminate them: a sticker on top shows far more.
• Scan them yourself from time to time, and avoid free link shorteners, which can expire or change hands.

And tell the team in one plain sentence: a QR code inside an email is, by itself, a warning sign.

What to do if it has already happened

• You entered a password: change it at once from another device, close open sessions and turn on two-factor authentication.
• You entered a card: call the bank right now to block it and dispute the charges.
• A subscription was activated: contact the operator, ask for cancellation and a refund, and keep the screenshots.
• They were your QR codes: photograph the stickers before removing them (they are the evidence), warn customers with a notice, and report it.

The full sequence for a payment that has already gone out is in the piece on the first 24 hours.

This article is general information, not legal or security advice for a specific case.