QR codes can conceal a harmful destination. Some email-security products can decode and analyze QR links, so do not assume every QR code bypasses filtering. Verify unexpected payment or sign-in requests independently.
It's called quishing (QR + phishing). The QR code in the email looks legitimate — it might say 'Scan to verify your Microsoft account' or 'Scan to view your FedEx package.' The destination is a pixel-perfect fake login page harvesting your credentials.
Physical QR codes are also a growing problem. Attackers print fake QR code stickers and slap them over real ones at parking meters, restaurant tables, and package drop boxes. You scan what looks like a legit code, and you're on a fake site.
The fix is simple: before you open any QR-scanned URL, read it. On iPhone, the camera shows a URL preview before opening — hold your camera on the code and check the domain. On Android, most apps show a preview. If the domain looks wrong, close it. If the URL is a shortened link (bit.ly, t.co) with no domain to read, treat it as suspicious. Real businesses don't need to hide where they're sending you.
And if you're using a QR code scanner app you downloaded at some point — delete it. Your phone's native camera already does this, and third-party scanner apps have been caught containing malware.
Sources for this correction, checked October 17, 2026: https://www.microsoft.com/en-us/security/blog/2024/11/04/how-microsoft-defender-for-office-365-innovated-to-address-qr-code-phishing-attacks/