You're reading The SME Security Brief, practical IT, cyber security and technology advice for Irish and UK businesses. No jargon. No scare tactics. Just what you need to know, every week.
If someone forwarded this to you, you can subscribe at thesmesecuritybrief.com.
THIS WEEK'S THREAT 🔴
Attackers are stopping sending links. Now they send QR codes. And it is working.
Over the past two years, email security has improved significantly. Filters are better at catching malicious links, suspicious attachments, and spoofed sender addresses. Organisations have invested in training staff to hover over links before clicking, to check URLs carefully, and to be suspicious of anything urgent or unexpected.
So attackers adapted. They started sending QR codes instead.
This is called quishing, a combination of QR and phishing, and it is one of the fastest growing attack methods targeting businesses right now. The reason it works so well is straightforward. When a security filter receives an email containing a QR code, it sees an image. It cannot read the URL hidden inside that image the way it can scan a written link. The filter waves it through. The email lands in your inbox looking clean.
The human on the other end then does what humans do with QR codes. They point their phone at it and scan it without thinking, because that is exactly what QR codes have trained us to do.
The attacks are convincing. Fake Microsoft login pages asking you to scan a code to verify your account. Fake parcel delivery notifications. Fake invoice payment confirmations. Fake HR policy documents with a QR code to access the updated version. The branding looks right, the language sounds plausible, and there is no link to hover over or URL to inspect before you have already gone somewhere you should not have.
It does not stop at email either. Physical quishing attacks are also being reported, where criminals print fake QR codes and stick them over legitimate ones. Car park payment terminals. Restaurant menus. Posters in hotel lobbies and conference venues. Even official looking notices stuck to office doors or reception desks. You scan what looks like a legitimate code, and you end up on a page that harvests your credentials or installs something on your phone.
Why this matters for your business,
Your email security tool is probably not scanning QR codes in incoming emails. Your staff have been trained to be careful with links, but almost certainly not with QR codes. And the attacks are increasingly targeted at business email accounts, finance teams, and anyone who regularly receives invoices, delivery notifications, or login prompts.
The gap between how cautious people are with links and how casually they treat QR codes is exactly where this attack lives.
What you should do this week,
Share this issue with anyone in your business who handles email, invoices, or supplier communications. The awareness alone is the single most useful thing you can do right now.
Ask your IT provider or IT support whether your email security tool has any capability to scan QR codes in emails. Many do not, and it is worth knowing.
The tip section below gives you and your team practical guidance on spotting a quishing attempt before it causes damage.
THIS WEEK'S TIP 💡
How to spot a QR code attack before you scan it.
The challenge with QR codes is that you cannot see where they go until after you have already scanned them. But there are things you can check before you point your camera, and habits that significantly reduce your risk.
Be suspicious of QR codes that arrive by email
A genuine organisation almost never needs to send you a QR code by email. Microsoft will not ask you to scan a code to verify your account. Your bank will not send you a QR code to confirm a payment. Revenue will not email you a QR code to access your tax records. If a QR code arrives in an email asking you to take urgent action, treat it the same way you would treat a suspicious link. Do not scan it without stopping to think about whether it makes sense.
Check the preview URL before you open it
When you scan a QR code with your phone's built in camera app, it will usually show you a preview of the URL before you tap to open it. Get into the habit of reading that URL before tapping. Does it match the organisation it claims to be from? Is it a genuine domain like microsoft.com or revenue.ie, or does it look slightly off, with extra words, strange characters, or an unfamiliar extension? If you are not sure, do not tap.
Use your phone's built in camera, not a third party QR app
Third party QR scanner apps often open URLs immediately without showing you a preview. Your phone's native camera app is safer because it shows you the destination first. If you or your team are using a separate QR scanning app, switch to the built in camera.
Be especially cautious with physical QR codes
If you are scanning a QR code in a public place, on a piece of equipment, or on a document you received unexpectedly, take a closer look at the physical code. Is it a sticker placed on top of something? Does it look like it was printed and stuck on rather than part of the original design? Fraudulent QR codes in public places are often identifiable by the sticker edge or slightly misaligned placement. If in doubt, do not scan it and contact the venue or organisation directly.
If you think you have scanned a malicious QR code
Do not enter any credentials or personal information on the page it takes you to. Close the browser immediately. If you entered any login details before realising something was wrong, change those passwords immediately and let your IT provider know. If the page prompted you to install anything, contact your IT support before using the device further.
THIS WEEK'S TOOL 🛠️
A simple QR code policy for your team.
You do not need a lengthy policy document. You need one set of clear rules that your team understands and can apply without thinking too hard. Here is a template you can share.
When it is fine to scan a QR code,
You are in a restaurant and the menu is a QR code. You are at an event and the QR code is printed on a physical badge, banner, or official signage you can see has not been tampered with. You generated the QR code yourself or asked a trusted colleague to generate it.
When to stop and think before scanning,
The QR code arrived in an email, even if the email looks legitimate. The QR code is on a sticker rather than printed directly on the surface. The QR code is asking you to log in to something, verify your account, or take urgent action. You did not expect to receive it.
The rule for email QR codes,
If a QR code arrives in your work email, do not scan it without checking with your IT provider or manager first. This applies even if the email appears to come from a trusted sender, because sender addresses can be spoofed.
The rule if something goes wrong,
Do not wait and hope for the best. Tell your IT provider or manager immediately, even if you are embarrassed. The sooner they know, the sooner they can limit the damage. There is no judgement in reporting a mistake quickly.
QUICK COMPLIANCE CHECKLIST
Five questions to ask about your current exposure to QR code attacks,
Has anyone in your business received training or guidance on QR code phishing, even informally?
Does your email security tool scan QR codes embedded in emails, or only written links?
Do your staff know to check the URL preview before tapping after scanning a QR code?
Do you have a clear process for staff to report something suspicious they may have clicked or scanned?
Are there any physical QR codes in your office or on your premises, such as for Wi-Fi access, that could be tampered with or replaced?
BEFORE YOU GO
QR codes became mainstream during the pandemic, when contactless everything suddenly felt essential. Menus, check-ins, payments, information boards. People learned to scan first and think later, and that habit has stuck.
Attackers noticed. They always do.
The good news is that awareness is most of the defence here. People who know that QR codes can be malicious treat them differently. They pause. They check the preview URL. They think about whether this makes sense before tapping.
That is not a technical skill. It is just knowing that the threat exists.
Share this issue with your team. It is a genuinely useful five minute read for anyone who uses a smartphone at work, which is everyone.
See you next week.
The SME Security Brief
Found this useful? Forward it to a business owner who would benefit. It takes two seconds and could save them a serious headache.
You're receiving this because you subscribed at thesmesecuritybrief.com. To unsubscribe, click here.
If you find this newsletter useful and want to show your support, you can buy me a coffee. It genuinely means a lot and keeps this going.
