Imagine an email arrives saying your work account will stop receiving messages unless you scan a QR code. You're already at your computer, but the message tells you to use your phone to complete a “security check”.
That change of device is a good moment to stop. Open your normal work sign-in page or contact your IT team through a route you already know. You don't need to follow the code to find out whether the request is genuine.
QR codes are useful shortcuts. The problem is that a printed square doesn't tell you much about where it leads or who put it there.
Treat the request like any other request
The NCSC's explanation of QR code risks describes how criminals use codes in phishing emails. A code can disguise a link, and scanning it may move someone from a managed work computer onto a personal phone with different protections.
Look at what the message wants you to do. Is it asking for a password, a payment, an authentication code or an app installation? Is that a normal part of the task you were doing?
A tidy logo and a familiar person's name aren't enough to answer those questions. Neither is arriving in the same inbox as genuine messages from that company.
For a small team, make the alternative easy. Put your actual IT contact and usual payroll, expenses and benefits links somewhere staff can find them without returning to a suspicious email. A warning to “be careful” is less useful when nobody knows the right route.
Use a route you already trust
If an unexpected QR request claims to concern an existing account, open the service through its known app or a saved address. Check there, or contact the organisation using details you've independently established. Don't use a telephone number supplied by the suspicious message to verify that same message.
The US Federal Trade Commission's QR scam guidance recommends checking unexpected requests through a known website or number. It also describes replacement stickers placed over genuine parking codes.
That doesn't mean every code on a poster is fraudulent. If you're at an unfamiliar car park or event, look for signs of tampering and check the operator through an independent route if anything seems wrong. A familiar-looking payment page alone doesn't establish that it belongs to the operator.
At work, a useful rule is that an urgent message cannot invent a new way to approve payments or reset accounts. Staff should still follow the normal process, even if the request arrives in a different shape.
A preview helps, but it isn't a verdict
Use the scanner built into your phone, as the NCSC recommends, rather than installing another scanning app for this task. Where it shows a link preview, read it before opening the page.
An obviously unrelated address is a reason to stop. An address that looks plausible still isn't a guarantee. On a small screen, long links can be difficult to assess, and shortened links hide the final destination.
Don't turn this into a test of who can decode the strangest web address. If a colleague can't confidently establish what they're being asked to do, they should use the known route or ask for help.
For an imagined expenses email, that could mean opening the usual expenses app and checking for a genuine request there. The employee can complete the job without ever using the emailed code.
If someone has already used it
Respond calmly and establish what happened. Seeing a preview, opening a page, entering a password and approving a sign-in are different actions. Scanning a code alone doesn't establish that an account or device has been compromised.
Ask the person to stop interacting with the page and contact the work IT or security contact promptly. They should explain what they entered, approved, downloaded or installed, and on which device. Don't ask them to send passwords or authentication codes in the report.
The NCSC's advice after sharing sensitive information covers changing exposed passwords, contacting IT and telling the bank when banking details are involved. Use the genuine service from a trusted device to change an exposed password, including on any other account where it was reused. Get IT help if software was installed or a device may be affected.
If a sign-in or app permission was approved, tell IT that specifically. Ask them to review the affected account and access. Don't assume changing a password settles every kind of approval.
Report the message without spreading it
Use your organisation's reporting route and keep the original message available for the responder. Avoid forwarding it around the team as a curiosity, where somebody else might try the code.
The NCSC explains how to report suspicious emails to its reporting service. Your IT contact can help follow that process without confusing it with the internal response. External reporting doesn't replace protecting an affected work account.
For a suspicious poster in your premises, tell the person responsible for the space. Have an authorised person deal with it and any replacement notice, rather than asking several colleagues to scan it and compare results.
Finally, make reporting easy to admit. A prompt “I entered my password here” gives the responder useful information. A team worried about being embarrassed may leave the same problem unreported for longer.