A message from the IT department: two-factor sign-in has to be set up again by Friday, the code to scan is enclosed. No link in the text, no attachment, just a square pattern. That is exactly the point — and it is not incidental but the reason for the whole construction.
Why an image gets past filters
A filter judging incoming mail inspects links. It reads the addresses out of the text, checks them against registers of known fraudulent sites, looks at the age of the domain and, where applicable, follows the redirect to see where it ends.
All of that presupposes an address present as text. In a QR code it is present as a pattern of black and white squares. To the filter that is an image — exactly like a logo or a photo.
The second part matters more
That the filter finds nothing is only half the effect. The other half is the change of device.
A QR code is scanned with a phone. That takes the whole business out of precisely the environment where safeguards apply:
- No company network. The request runs over the mobile connection. A network filter blocking known fraudulent sites never sees it.
- No managed software. The personal phone runs none of the employer's protective tooling.
- A tiny address bar. What is visible of a long address on a phone screen is the first few characters. An address beginning with the company name and carrying the actual domain somewhere near the end looks entirely unremarkable there.
- No trace for IT. If somebody later wants to establish what happened, there is nothing to find on the company side.
An attack that gets a person to step off the protected device has half the work behind it.
The pretexts that turn up
A QR code needs a justification, or it looks odd. The usual justifications repeat:
- Re-enrolling two-factor. The strongest pretext, because it makes scanning technically plausible — genuine enrolment really does run through a code. Whoever scans lands on a rebuilt sign-in page.
- A document from HR, "reachable only via the code for security reasons". The contradiction rarely registers in the moment.
- A parcel notification with a fee supposedly due.
- An invoice with a payment code. In countries with widespread instant payments this is the shortest route to the money.
All four follow the same pattern as other fraudulent messages: an occasion, a deadline, a single route to settling it. The markers are the same — only the click has been replaced by a scan.
And the same trick on paper
The physical variant needs no technical effort at all: a sticker over the genuine QR code. On parking meters, on notices at charging points, on table stands in restaurants. The code underneath stays intact; the one on top gets read.
The countermeasure is unglamorous and effective: before scanning at a machine, run a finger over the code. A sticker can be felt.
What actually helps
Look at the address before opening. The camera apps on iOS and Android show the destination address before they open it. That preview is the one moment where something can be decided — and it is usually tapped away because it is in the way.
Read the end of the domain, not the beginning. In company.com.secure-signin.example the domain is secure-signin.example. The part before it is freely chosen and exists precisely to be read.
Never follow a code to a sign-in. The rule that covers everything: you open a sign-in page yourself — from a bookmark or a typed address. No legitimate process that requires signing in gets any worse because you chose the route there yourself.
In an organisation: state the rule and keep to it. "We never send QR codes for sign-in" is an announcement everybody understands and every message can be checked against. It only works, though, as long as your own IT department abides by it.
On the filtering side: some systems now decode codes in images themselves and judge the contained address in the ordinary way. That is the right answer at the technical level — it is simply not present everywhere, and the change of device remains even then.