Scan Here to Claim Your Reward? How a Fake QR Code Steals Your Password
A "free lunch voucher" poster appears at the office. One quick scan opens a page that looks exactly like your company's login portal… but is it?
Watch “Scan Here to Claim Your Reward? How a Fake QR Code Steals Your Password” (1:22)
Transcript
A "free lunch voucher" poster appears at the office. One quick scan opens a page that looks exactly like your company's login portal… but is it?
In this short animated story, Priya scans a QR code that leads to a look-alike sign-in page. Before typing her password, she checks the web address and spots that it has nothing to do with her company. She closes the page and reports the poster, before anyone else falls for it.
This attack is called QR code phishing, or "quishing". Scammers place fake QR codes on posters, flyers and stickers in offices, car parks and cafés to steal login details.
Key lessons
- QR codes can hide malicious links, just like ordinary hyperlinks
- Preview the destination: read the web address your camera shows before opening it
- Verify the domain: is it really your organisation's website?
- Never enter your credentials on a page you reached by scanning a code. Go to the company portal directly instead
- Report suspicious posters or QR codes to your IT or security team
⏱ CHAPTERS 0:00 The "free lunch" poster 0:14 Scanning the QR code 0:28 Spotting the fake web address 0:39 How QR code phishing works 0:51 Close it and report it 1:01 Key lessons
PhishFoil helps teams recognise and stop phishing through short, story-based security awareness training. Subscribe for more bite-sized cybersecurity lessons.