A QR code is a two-dimensional barcode that encodes text, usually a URL. Phishing operators put QR codes in email for a simple reason: the link inside the code is not visible as text. Filters that scan message bodies for suspicious URLs may see only an image. The person who scans the code then opens the destination on a phone, often outside the protections of a desktop browser and any proxy or endpoint tool that would otherwise warn about it.
How the attack is staged
The message usually looks routine: a password expiry notice, a shared document, a voicemail transcript, an invoice, or an instruction to set up two-factor authentication. The QR code is presented as the fastest way to finish the task. The code leads to a page that imitates a sign-in screen for a mail provider, a file-sharing service or a major identity provider. Entering a password there hands it to the attacker. If the attacker relays the login in real time, a one-time code is captured as well.
Two features make this hard to spot. The destination is never shown in the mail client, so hovering over anything reveals nothing useful. And the phone camera typically shows the URL only after a tap, by which point the page may already be loading.
Legitimate QR codes exist
QR codes are not suspicious in themselves. Authenticator enrollment screens, event tickets and some hardware setup guides use them legitimately. The question is whether the context makes sense. Ask:
- Did I start this action, or did the email ask for something I did not request?
- Does the sender's domain match the service the code claims to belong to?
- Is there urgency, a threat of account loss, or a short deadline?
- Would I normally type this destination into a browser?
How to respond
If an unexpected QR code arrives, do not scan it with a phone that is signed in to the account it names. Then:
- Do not scan the code and do not enter credentials anywhere the message led you.
- If you want to verify the claim, open the service the way you always do: a bookmark, the official app, or an address you typed yourself. Do not reuse links or codes from the message.
- If you already scanned the code and entered a password, change it from a session you trust, sign out other sessions, and check whether the account now has a new second factor you did not add. Prefer a FIDO2 security key for the account afterwards. Origin binding makes it much harder for a relay page to reuse a key than a typed one-time code.
- Look at recent sign-in activity, forwarding rules, filters and app authorizations. Attackers who get into a mailbox often add a forwarding rule or filter so they keep receiving mail and hide their own messages.
- Report the message. For ITProMail accounts, forward the suspicious message as an attachment to security@itpromail.com. Use abuse@itpromail.com for spam and abuse reports.
Reducing exposure
For an individual, the practical defense is a habit: treat a QR code in an unsolicited message the same way you treat an unsolicited link. For a team, write down a rule that account actions start from bookmarks or official apps, never from an inbound message. Keep phone and mail apps current. A password manager is useful here because it matches credentials to the exact domain they were saved for. If the page is on a lookalike domain, the manager offers nothing, which is a signal in itself.
Authentication records help identify forged senders, but they do not inspect what a QR code points to. The mechanics of SPF, DKIM and DMARC are covered in SPF, DKIM and DMARC explained. The wider set of lures that accompany these messages is in spotting modern phishing. For the second-factor options mentioned above, see the TOTP and FIDO2 guides.