A QR code in your work email? Check it before you scan

An email asking you to scan a QR code to open a document or sign in asks you to move part of the task from your computer to a phone. That may put the next step outside the URL checks your organisation applies to the computer. Pause, confirm the request through a contact route you already trust, and use your organisation’s normal sign-in page. Don’t enter a work password on a page reached only through an unexpected QR code. The FBI’s 8 January 2026 alert describes QR codes being used to move targeted work sign-ins onto mobile devices.

A QR code used for sign-in carries a destination; it does not prove who created the code or whether that destination is legitimate. That does not make every QR code dangerous. It means the code itself is not a trust signal.

What the January 2026 FBI alert actually said

The FBI’s 8 January 2026 FLASH focused on a specific threat. It says that, as of 2025, Kimsuky actors had used QR codes in spearphishing aimed at think tanks, academic institutions, and US and foreign government entities. The report gives examples from May and June 2025: codes that purported to open questionnaires or secure drives, and a conference invitation that led to a fake Google sign-in page.

In the campaigns described, the QR image hid a URL from the usual link checks on the recipient’s computer. Scanning moved the person to a phone, where the page could imitate Microsoft 365, Okta or a VPN portal. The FBI says the activity could include stealing and replaying session tokens, which may let an attacker reuse an already-authenticated session.

Those are targeted campaigns described by the FBI, not evidence that every QR sign-in request is malicious or that the same actors target ordinary home users. The practical lesson is narrower: if a work message unexpectedly tells you to use a phone to sign in, verify the request before doing so.

Why a QR code changes the check

A clickable link can be inspected as a URL before you open it, although its displayed label is not proof of its destination. A QR code stores its destination inside an image, so an email that contains only the image may not expose a link for your organisation’s email tools to inspect. The FBI says the campaigns in its alert used QR images to evade URL inspection, rewriting and sandboxing.

Moving to a personal phone can also change which device and network controls apply. It does not mean a phone is automatically unsafe; it means a work sign-in has crossed to another device. If your organisation has an approved mobile sign-in or QR workflow, use that. If the request is new or unexpected, check with IT through a known route.

Before you scan

1. Ask whether you expected the code. Were you already trying to sign in or open a document? Does the message explain why the code is needed? A surprise request with a deadline or threat deserves extra scrutiny. The Federal Trade Commission (FTC) describes similar urgency in QR-code messages about account problems and deliveries in its consumer guidance .
2. Verify the request independently. For a work or school account, contact the sender or IT using an address, phone number or helpdesk page you already know. Do not rely on the contact details or sign-in link inside the message you are checking. If the request is legitimate, the organisation can confirm the approved way to complete it.
3. Look at the code’s source. If a QR code is printed on a parking meter, noticeboard or payment sign, check for a sticker placed over the original. The FBI has warned that criminals can replace physical and digital codes to redirect payments or steal login details. For a payment, confirm the merchant and amount in the payment app before approving it; use the merchant’s official app or type a known web address if anything looks different.
4. Preview the destination before opening it. Use your phone’s built-in camera or scanner. If it shows a destination preview, inspect the URL before opening it. The FBI advises against installing a separate QR-scanner app or downloading an app directly from a QR code. Find software through the official app store instead.
5. Check the actual site name. In a web address, look at the host after “https://” and before the next slash. For example, the address “https://login.microsoftonline.com.example.net/approve” is under “example.net”; the Microsoft-looking words earlier in the address do not make it a Microsoft site. If you cannot confidently identify the organisation’s real domain, close the preview and open its known app or website yourself.

If you already scanned it

The next step depends on what happened after the scan. Opening a page is different from entering a password, approving a sign-in or installing an app. A scan by itself does not prove that your device or account was compromised.

• The link opened, but you did nothing else: close the page. Do not download a file, allow a new permission or continue to a sign-in prompt. If it was a work code, report it to IT so they can check the message and the destination.
• You entered a work password or approved a sign-in: contact IT immediately using your normal helpdesk or incident-reporting route. Tell them which account and device you used, when it happened, and whether you entered a password or approved a prompt. The FBI’s alert describes session theft that may not produce a typical failed-MFA warning, so do not wait for an alert before reporting it.
• You entered a personal password: from a device you trust, open the service through its official app or a saved address. Change the password, turn on multi-factor authentication if it is not already enabled, and review the provider’s account-recovery and active-session options. The FTC recommends changing credentials and enabling two-factor authentication after someone enters them on a phishing page.
• You installed an app, granted access or made a payment: contact your organisation’s IT team, the relevant service or your bank through its official channel. Keep the message and any transaction details. Follow the device maker’s or service provider’s recovery instructions rather than installing a cleanup tool promoted by another pop-up.

A short note for organisations

Give staff a clear way to report suspicious QR codes and tell them how to verify a sign-in through a second channel. The FBI also recommends assessing QR-linked URLs before they reach a mobile device and using phishing-resistant multi-factor authentication for sensitive access. A reporting process helps security teams see the message and the route it took, even when an employee scanned it on a personal phone.

For a sign-in request, treat the QR code as a link with a hidden address. Check why it was sent, confirm the request through a route you already trust, and use the sign-in path your organisation has approved.

Sources and further reading

• FBI, “North Korean Kimsuky Actors Leverage Malicious QR Codes in Spearphishing Campaigns Targeting U.S. Entities” (8 January 2026)
• FTC, “Scammers hide harmful links in QR codes to steal your information” (6 December 2023)
• FTC, “Scam alert: QR code on an unexpected package” (January 2025)
• FBI, “Cybercriminals Tampering with QR Codes to Steal Victim Funds” (18 January 2022)