A QR code can hide a scam link. Check where it goes before paying

A QR code makes opening a menu, checking a ticket or reaching a payment page convenient. It can also make the destination harder to judge before you arrive.

The Australian Cyber Security Centre describes “quishing” as phishing carried out through QR codes. The code can direct someone to a malicious website or a file intended to compromise a device. A copied logo or a familiar-looking page does not establish that the destination is genuine. [1]

This security explainer describes an established scam technique. It does not report a newly identified incident or suggest that all QR payments are unsafe.

Pause at the destination

Treat the destination as the thing you need to assess. If your phone shows a link preview, read it before opening the page. If the address is unfamiliar or the request is unexpected, reach the organisation through a route you already trust.

For a payment, that may mean opening the known official app or asking the business to confirm its payment process. Do not use a phone number supplied by the suspicious page as the only way to verify the page.

Imagine an email asking you to scan a code to fix an urgent account problem. Before following it, open the account through your usual route and check whether the same issue appears there. That is a hypothetical example, not evidence about a particular company.

Urgency deserves another check

Cyber.gov.au's scam guidance describes messages that imitate trusted organisations and pressure people to act. Requests built around fear, a deadline or an unexpected benefit can make it harder to pause and verify. [2]

Ask what you were expecting to do before the message arrived. A routine booking confirmation and an unrequested demand for bank details are different situations.

Keep the original message if you need to report it. Avoid forwarding a clickable code to friends with a vague warning, which may spread the link without explaining the risk.

Be careful when a work message moves to your phone

The Cyber Security Centre notes that scanning a code from a work email on a personal device can move the interaction outside the organisation's usual controls and monitoring. [1]

If an unexpected message asks you to scan a code to sign in, follow your workplace reporting process. The fact that it arrived at work does not establish that the personal phone interaction is approved.

Explain what happened, including whether you scanned, opened a page, entered information or downloaded anything. Those are different stages, and the person helping you needs an accurate account.

If you have already interacted with it

Do not assume every scan means an account has been compromised. Equally, do not ignore a request for credentials or a payment that you now believe was fraudulent.

Use Cyber.gov.au's recovery guidance to work out the relevant response. If money or banking details are involved, contact the financial institution through its official channel promptly. If it is a work device or account, notify the appropriate support team. [3]

Record the time and the actions you took. Keep sensitive details out of a public post about the incident.

For your next legitimate QR interaction, build in one short pause to confirm the destination and purpose. The convenience remains useful when you can establish where the code is taking you.