QR codes save time. Staff use them to open menus, join guest Wi-Fi, pay for parking, confirm deliveries, and sign in to services. That convenience is exactly why scammers keep using them.

A QR code can hide the real destination until after someone scans it. If a fake code leads to a lookalike login page, a rushed employee might hand over a password without realising it. For small and mid-sized businesses, that can become an email takeover, a payment scam, or an avoidable support incident.

The good news is that staff do not need to fear every QR code. They just need a simple pause-and-check habit.

A practical QR code safety checklist

1. Stop if the code arrived unexpectedly.
If a QR code shows up in an email, text, printed note, or package message you were not expecting, treat it as suspicious first. Urgency is a common scam tactic.

2. Preview the destination before opening it.
Most phones show the web address before you continue. Read it carefully. Misspellings, extra words, odd subdomains, or a domain that does not match the company are all warning signs.

3. Be extra careful with QR codes that ask you to log in.
If the code claims your account has a problem, your parcel could not be delivered, or you need to reset a password, do not trust the scan alone. Open the official app or type the known website address yourself instead.

4. Avoid scanning codes in emails unless you can verify them another way.
Scammers increasingly use QR codes in emails because they can hide malicious links inside an image. If the message looks important, contact the sender or supplier using a phone number or website you already trust.

5. Check the physical location.
In public places, look for tampering. A fake sticker placed over a real code can redirect payments or harvest credentials. If a code looks newly pasted on top of another sign, do not use it.

6. Keep phones and accounts protected.
Device updates, strong unique passwords, and multi-factor authentication reduce the damage if someone does land on a malicious page.

A simple office rule that helps

Give staff one clear rule: never use a QR code to sign in to a business account unless you were expecting it and you have checked where it goes.

That single habit can prevent many fake Microsoft 365, Google Workspace, courier, banking, and payroll login scams. It also gives employees permission to slow down instead of reacting to pressure.

If someone already scanned a suspicious code

Act quickly. Close the page, do not enter more information, change the password if credentials were submitted, and notify your internal IT contact or support provider. If the same password was reused anywhere else, change it there too.

For many businesses, the biggest risk is not the scan itself. It is the delay in reporting it.