Direct answer
Treat an unexpected QR code like an unexpected link: pause, verify the request through a trusted channel and avoid entering credentials or payment details. A QR image can hide its destination until a device reads it, so its appearance alone is not evidence of legitimacy.
Check the reason for the request
A code on a parking meter, delivery notice or workplace email might claim payment is overdue. Compare the request with what you expected and use a known app, official website or published telephone number rather than the contact details supplied beside the code.
A sticker placed over a printed code is a reason to ask the venue, but an unaltered appearance does not establish that the destination is safe.
Reference: CISA: Recognize and report phishing.
Keep the image out of the critical path
Do not scan the code simply to discover whether it is trustworthy. At work, follow the security team's reporting process and preserve the message or photograph only as instructed. Avoid forwarding a suspicious image to a large group where someone might accidentally open it.
- Record where and when the code appeared and the action it requested.
- Check the request with the organization using an independently obtained contact.
- Do not type passwords or card details into an unexpected page.
If you already scanned it
A scan, a page visit, a download and credential entry are different events. Record which occurred without revisiting the page. If you entered a password, change it through a trusted route, address reuse and tell your security team or service provider. If payment details were supplied, contact the card issuer promptly.
Reference: FTC: What to do if you were scammed.
Use analysis tools carefully
A URL extracted from a code may be examined with a link tool, but a clean-looking address does not verify ownership or reveal the behavior of the destination. PhishLens does not decode QR images; its initial address review is local and optional external checks provide domain context, not a safety verdict.
Assessment limits
QR code context and URL patterns are clues, not proof of fraud or safety. Organizational procedures and the response to an interaction depend on what was disclosed or downloaded.
Frequently asked questions
Is every QR code in email malicious?
No. QR codes have legitimate uses, but unexpected requests should be verified through a known channel before entering sensitive information.
Does scanning a QR code always compromise a device?
No. The effect depends on what the device did and what information was entered. Report the exact interaction and follow the relevant response process.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.