Check the source and purpose before scanning
An unexpected QR code deserves the same action check as an unexpected link. Ask who provided it and what it is supposed to enable. An invoice, delivery notice or account warning may use a code to move you to a destination that is harder to inspect in the original message. An urgent explanation does not supply permission to enter credentials or change payment details.
The FTC describes deceptive QR destinations and codes placed over legitimate ones. Treat that as a reason to check the context, not proof that every physical sticker is malicious. If the service is known, reach it through its established app or address. In a workplace, confirm an unexpected code with the relevant owner without using contact details printed alongside the questionable request.
Keep a destination preview separate from trust
A preview can show useful information, but it cannot decide whether the underlying request is legitimate. If the device only offers to open a destination automatically, do not proceed merely to inspect it. Ask for the expected task through the known service instead. An unfamiliar address can remain unresolved while a technical owner handles the message through an approved process.
A recognizable word in a long destination is not a verification method. The code may point to an intermediary or a changing destination, and the final page still needs its own action check. Do not upload private login, invitation or payment codes to a public decoder. Some codes contain access-bearing information; sharing them can create a separate exposure even if the original request was legitimate.
Record which stage actually occurred
Our QR stage matrix prevents the report from collapsing every interaction into the statement I scanned it. A camera preview, browser visit, password entry and application approval have different implications. Record the stages you can establish and mark the rest unknown. Do not repeat the sequence on another device to make the report more complete.
Include which device and account were involved. A business email viewed on a managed computer may lead someone to complete the request on a personal phone, so the email administrator may not see the whole sequence. An accurate cross-device account helps the owner select the relevant account, device or financial response without treating scanning alone as proof of compromise.
| Observed stage | What to establish | Practical next step |
|---|---|---|
| Code received only | Source and requested action. | Do not scan to satisfy urgency. |
| Preview shown | Whether a destination was actually opened. | Use the known service independently. |
| Page opened | Device, time and any later interaction. | Report the sequence; stop further interaction. |
| Information entered | Account, password reuse or financial details. | Use the relevant account or bank response. |
| Access approved | App, permission or sign-in approval. | Ask the administrator to review that authorization. |
| File or app installed | What ran and which device is affected. | Use the organization’s device-response process. |
Treat an unexpected QR sign-in as an authorization request
Not every QR sign-in is phishing. Legitimate services can use codes to connect a device or approve an account action. That is exactly why context matters: a real provider page does not establish that the session being approved belongs to the employee's intended task. Confirm which device, application and permission are being authorized before completing a prompt.
If a message asks staff to scan a code to avoid losing mailbox access, use the known account portal or contact the established administrator. Do not approve a session simply because the next page displays familiar branding. If access was already approved, preserve the prompt details that remain available and ask the account owner to review sessions and application permissions through current provider procedures.
If you acted, follow the relevant exposure branch
Stop interacting with the destination and report the sequence. The UK NCSC distinguishes a visit without information entry or installation from cases involving passwords, banking details or software. Avoid treating every scan as a confirmed infection, while still telling the workplace owner what happened. If financial information or a transfer is involved, use a verified bank contact promptly.
A password change may be only part of an account response when access was granted. A downloaded file that never ran is also different from an installation or remote-control session. Give the administrator the facts needed to make those distinctions. Avoid deleting everything, revisiting the destination or forwarding a live code widely in an attempt to help; use the agreed evidence and reporting route.
Reduce confusion around QR codes your business publishes
A business that publishes its own codes can make the expected action and official destination clear in ordinary text. Assign an owner for where codes appear and how destination changes are approved. Review physical placements for replacement labels and provide a non-code route where practical. These are proposed controls to make verification easier, not a guarantee that a code cannot be misused.
CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide. We bring practical Israeli technical knowledge to website, account and business-email controls. A scoped technical enquiry can clarify the relevant destination, permission and ownership questions. Do not submit a live access-bearing code or sensitive customer data through the initial form; agree an appropriate method first if such evidence is required.
