QR codes in emails and PDFs: the account-theft scam

Why scammers put the link in a QR code

Email filters check the links inside a message. A QR code is a picture, often inside a PDF attachment, so many filters never see the address it holds. When you scan it, the page opens on your phone, which usually has less protection than a work computer and is outside your company’s security tools.

In January 2026 the FBI warned that a North Korean group was sending emails with QR codes to think tanks, universities and government staff, posing as advisers, embassy staff and conference organisers. The codes led to fake sign-in pages. The FBI noted that QR images in attachments and embedded graphics slip past link checking and scanning.

The same trick is common in ordinary crime. Barracuda researchers counted more than 500,000 phishing emails with QR codes in PDF attachments between June and September 2024. Most posed as Microsoft SharePoint or OneDrive (51%), DocuSign (31%) or Adobe (15%).

What these emails usually say

• “Your password expires today. Scan to keep the same password.”
• “Your multi-factor authentication must be re-enrolled.”
• “A document has been shared with you” or “Please sign this agreement”.
• “You have a new voicemail”, “Your payroll details need updating” or “Invoice attached”.
• A PDF that contains only a logo, a short message and a QR code, with no other links.

Red flags

• Any email that asks you to scan a QR code to sign in. Microsoft, Google, banks and your IT team do not need you to move to your phone to keep your password.
• Urgency: expires today, final notice, account will be locked.
• The page that opens is not microsoft.com, live.com, google.com, docusign.com, adobe.com or your company’s own domain. Look-alikes such as micros0ft-verify.com or docusign.secure-review.app are not those companies.
• A sign-in page reached through a QR-code service, a free website builder or a file-sharing link.
• You are asked for your password and then the code from your authenticator app.

What to do

• Do not scan QR codes in emails to sign in. Open the service yourself: type its address or open its official app.
• At work, forward the email to your IT or security team and delete it.
• If you are unsure whether a message is real, contact the sender another way, for example by phone, as the FBI recommends.
• If you typed a password on such a page, change it right away from the real site, sign out of other sessions and tell your IT team.
• To see where a code really goes without opening it, scan it with QR Snap first.

What QR Snap checks before you open a link

QR Snap shows you the link first and does not open it until you tap. Before you do, it runs these checks:

• Where it really goes. Short links and redirects are followed to the page they end on, and QR Snap shows that site ("Opens example.com, after 2 redirects").
• Known threats. The link and its destination are checked against Google Web Risk and a public list of active phishing sites.
• Look-alike names. A company name on a site it does not own, misspellings like paypa1 or rnicrosoft, letters from other alphabets, and an "@" that hides the real address.
• Free website builders and file hosts. A payment or sign-in page hosted on a free site builder, a dynamic-DNS name or a storage bucket is a common scam setup.
• Brand-new websites. Most scam sites are days or weeks old, so QR Snap shows when the site was registered.

What no checker can promise

New scam sites appear every day, and some hide behind bot checks so automated tools only see a harmless page. A clean result means none of the checks found a known threat, not that the page is guaranteed safe. If a page asks for card details or a password you did not expect to give, close it and go to the company yourself: type its address or open its official app.

Sources

• FBI FLASH: North Korean Kimsuky actors use malicious QR codes in spearphishing (January 2026)
• Infosecurity Magazine: FBI warns of North Korean QR phishing campaigns (January 2026)
• ITPro: Barracuda finds 500,000 phishing emails with QR codes in PDFs (October 2024)
• FTC: Scammers hide harmful links in QR codes to steal your information