QR-code phishing
QR-code phishing is phishing that uses a QR code to direct someone to a deceptive website or another attacker-directed interaction, such as entering credentials or approving access.
The code is a way to deliver the request
A QR code can carry a web address. Scanning it saves you typing that address, but tells you nothing about who runs the destination. Attackers put codes in messages and documents, or replace legitimate printed codes with their own.
The page you reach determines what happens next. It might collect a password, request payment details, or ask you to approve something. Scanning a code and submitting a password are different actions; a report should not treat them as interchangeable.
In a January 2026 advisory, the FBI described Kimsuky emails that advertised a nonexistent conference. A QR code led to a registration page, which then directed people to a fake Google sign-in page. The deception continued after the scan.
Moving to your phone can change what the security team sees
An email may arrive on a work laptop while the linked page opens on a personal phone. The laptop’s security tools may not see what happens in that phone’s browser. That does not mean QR codes bypass every email or mobile security control.
Preview the destination where your scanner supports it. For an unexpected account request, open the service through your usual app or bookmark instead. If you already interacted, report the original message and say which device you used and what you actually did. What to report after scanning a QR code walks through those details.
QR-code phishing is not another name for device-code phishing. A QR code is a delivery format; device-code phishing abuses a particular authorization flow. Likewise, a messenger device-linking code can authorize a new device rather than open a sign-in form.