[{"data":1,"prerenderedAt":172},["ShallowReactive",2],{"publication:en:P086":3},{"meta":4,"copy":17,"relatedArticles":133,"terms":164,"term":165,"resourceParent":166,"glossaryParent":169},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":15,"preparedOn":16},"P086","\u002Fblog\u002Fqr-phishing-check","article","how to spot QR code phishing","How to spot QR code phishing without opening the destination","QR code phishing: check before you scan or sign in","Assess unexpected QR codes, trusted destinations and cross-device risks. Separate scanning, opening, signing in and granting access when reporting an event.",[13,14],"\u002Fservices\u002Femail-domains","\u002Fservices\u002Faccess-2fa-audit","2026-07-30","2026-10-30",{"intro":18,"sections":19,"checklist":92,"faq":98,"links":108,"sources":125,"cta":128},"To spot QR code phishing, check where the code came from, what action it requests and whether you can reach the expected service through a known app or address instead. A QR code makes a destination convenient to open; it does not verify the destination or authorize a login. If you already scanned it, distinguish previewing, opening, entering information and granting access before choosing the response.",[20,29,34,70,78,87],{"title":21,"paragraphs":22,"sources":25},"Check the source and purpose before scanning",[23,24],"An unexpected QR code deserves the same action check as an unexpected link. Ask who provided it and what it is supposed to enable. An invoice, delivery notice or account warning may use a code to move you to a destination that is harder to inspect in the original message. An urgent explanation does not supply permission to enter credentials or change payment details.","The FTC describes deceptive QR destinations and codes placed over legitimate ones. Treat that as a reason to check the context, not proof that every physical sticker is malicious. If the service is known, reach it through its established app or address. In a workplace, confirm an unexpected code with the relevant owner without using contact details printed alongside the questionable request.",[26],{"label":27,"url":28},"FTC (2023): unexpected QR codes and misleading destinations","https:\u002F\u002Fconsumer.ftc.gov\u002Fconsumer-alerts\u002F2023\u002F12\u002Fscammers-hide-harmful-links-qr-codes-steal-your-information",{"title":30,"paragraphs":31},"Keep a destination preview separate from trust",[32,33],"A preview can show useful information, but it cannot decide whether the underlying request is legitimate. If the device only offers to open a destination automatically, do not proceed merely to inspect it. Ask for the expected task through the known service instead. An unfamiliar address can remain unresolved while a technical owner handles the message through an approved process.","A recognizable word in a long destination is not a verification method. The code may point to an intermediary or a changing destination, and the final page still needs its own action check. Do not upload private login, invitation or payment codes to a public decoder. Some codes contain access-bearing information; sharing them can create a separate exposure even if the original request was legitimate.",{"title":35,"paragraphs":36,"table":39},"Record which stage actually occurred",[37,38],"Our QR stage matrix prevents the report from collapsing every interaction into the statement I scanned it. A camera preview, browser visit, password entry and application approval have different implications. Record the stages you can establish and mark the rest unknown. Do not repeat the sequence on another device to make the report more complete.","Include which device and account were involved. A business email viewed on a managed computer may lead someone to complete the request on a personal phone, so the email administrator may not see the whole sequence. An accurate cross-device account helps the owner select the relevant account, device or financial response without treating scanning alone as proof of compromise.",{"caption":40,"headers":41,"rows":45},"QR interaction and next decision",[42,43,44],"Observed stage","What to establish","Practical next step",[46,50,54,58,62,66],[47,48,49],"Code received only","Source and requested action.","Do not scan to satisfy urgency.",[51,52,53],"Preview shown","Whether a destination was actually opened.","Use the known service independently.",[55,56,57],"Page opened","Device, time and any later interaction.","Report the sequence; stop further interaction.",[59,60,61],"Information entered","Account, password reuse or financial details.","Use the relevant account or bank response.",[63,64,65],"Access approved","App, permission or sign-in approval.","Ask the administrator to review that authorization.",[67,68,69],"File or app installed","What ran and which device is affected.","Use the organization’s device-response process.",{"title":71,"paragraphs":72,"example":75},"Treat an unexpected QR sign-in as an authorization request",[73,74],"Not every QR sign-in is phishing. Legitimate services can use codes to connect a device or approve an account action. That is exactly why context matters: a real provider page does not establish that the session being approved belongs to the employee's intended task. Confirm which device, application and permission are being authorized before completing a prompt.","If a message asks staff to scan a code to avoid losing mailbox access, use the known account portal or contact the established administrator. Do not approve a session simply because the next page displays familiar branding. If access was already approved, preserve the prompt details that remain available and ask the account owner to review sessions and application permissions through current provider procedures.",{"title":76,"text":77},"Illustrative example: email on one screen, sign-in on another","A fictional employee receives an unexpected mailbox-renewal message on a work laptop. A QR code asks them to finish the task on a phone. They open the known account portal independently and ask their administrator whether any action is required. They do not scan the code or approve another session. The example demonstrates a verification choice, not a claim about a specific provider or observed campaign.",{"title":79,"paragraphs":80,"sources":83},"If you acted, follow the relevant exposure branch",[81,82],"Stop interacting with the destination and report the sequence. The UK NCSC distinguishes a visit without information entry or installation from cases involving passwords, banking details or software. Avoid treating every scan as a confirmed infection, while still telling the workplace owner what happened. If financial information or a transfer is involved, use a verified bank contact promptly.","A password change may be only part of an account response when access was granted. A downloaded file that never ran is also different from an installation or remote-control session. Give the administrator the facts needed to make those distinctions. Avoid deleting everything, revisiting the destination or forwarding a live code widely in an attempt to help; use the agreed evidence and reporting route.",[84],{"label":85,"url":86},"UK NCSC: actions after a suspicious link or disclosure","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fsection\u002Frespond-recover\u002Fphishing",{"title":88,"paragraphs":89},"Reduce confusion around QR codes your business publishes",[90,91],"A business that publishes its own codes can make the expected action and official destination clear in ordinary text. Assign an owner for where codes appear and how destination changes are approved. Review physical placements for replacement labels and provide a non-code route where practical. These are proposed controls to make verification easier, not a guarantee that a code cannot be misused.","CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide. We bring practical Israeli technical knowledge to website, account and business-email controls. A scoped technical enquiry can clarify the relevant destination, permission and ownership questions. Do not submit a live access-bearing code or sensitive customer data through the initial form; agree an appropriate method first if such evidence is required.",[93,94,95,96,97],"Identify the code’s source and the action it requests.","Use the known app or website instead of an unexpected code.","Do not submit private codes to a public decoding service.","Record the device and actual interaction stage if anyone acted.","Review account, installation and payment exposure separately.",[99,102,105],{"question":100,"answer":101},"Does merely scanning a QR code mean my phone was hacked?","No: establish whether a preview appeared, a page opened, information was entered, access was approved or software ran. Scanning alone does not establish compromise.",{"question":103,"answer":104},"Is a familiar login page enough to approve a QR request?","No: confirm that the session, device and requested action are the ones you intended. A legitimate page can still be part of an unwanted authorization flow.",{"question":106,"answer":107},"Can I send the QR code to an online decoder?","Avoid uploading private sign-in, invitation or payment codes publicly. Use the organization’s approved review route because the code may contain sensitive or access-bearing information.",[109,112,115,118,121,123],{"path":110,"label":111},"\u002Fglossary\u002Fphishing","Understand phishing across delivery channels",{"path":113,"label":114},"\u002Fblog\u002Fphishing-link-clicked","Respond according to what happened after opening",{"path":116,"label":117},"\u002Fblog\u002Fidentify-phishing-message","Review the requested action before proceeding",{"path":119,"label":120},"\u002Fblog\u002Fmicrosoft-365-account-compromise","Use the Microsoft 365 account-response guide",{"path":13,"label":122},"Review business email controls",{"path":14,"label":124},"Scope account permissions and sign-in protection",[126,127],{"label":27,"url":28},{"label":85,"url":86},{"title":129,"description":130,"button":131,"type":132},"Clarify a QR-related account or website concern","Describe where the request appeared and what was done, without including passwords, live login codes or confidential records.","Discuss the technical concern","check",[134,143,151,158],{"id":135,"path":136,"title":137,"description":138,"category":139,"artwork":140,"order":141,"publishedOn":142},"P087","\u002Fblog\u002Fdeepfake-payment-call","Deepfake voice payment scam prevention for business teams","Verify urgent voice and video payment requests through trusted contacts and approval rules. Build a process that does not depend on spotting fake audio.","access","support",32,"2026-07-16",{"id":144,"path":145,"title":146,"description":147,"category":139,"artwork":148,"order":149,"publishedOn":150},"P085","\u002Fblog\u002Finvoice-bank-change-scam","How to verify supplier bank account changes before paying","Use a trusted callback, separate approval and a recorded supplier-change check. Know what to do if payment details were changed or money was sent.","email",43,"2026-08-15",{"id":152,"path":113,"title":153,"description":154,"category":139,"artwork":155,"order":156,"publishedOn":157},"P116","Clicked a phishing link? Choose the response by what happened","Separate a link visit from password entry, MFA approval, app consent and software installation. Report clearly and choose account, device or payment response.","security",28,"2026-06-30",{"id":159,"path":116,"title":160,"description":161,"category":139,"artwork":148,"order":162,"publishedOn":163},"P191","How to identify a phishing message before taking action","Check the requested action, sender, destination and independent verification route. Learn what polished messages and familiar threads cannot establish.",49,"2026-08-29",[],null,{"path":167,"label":168},"\u002Fresources","Website security resources and templates",{"path":170,"label":171},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134059132]