QR Code and SMS Scams Targeting Businesses
Scammers have followed your team from the inbox to the phone. Fake QR codes and urgent text messages slip past email filters and catch people when they are busy, on the move and less careful. This explainer shows how quishing and smishing work against businesses and the habits that stop them.
Key takeaways
- Quishing uses QR codes, on stickers or inside emails, to send people to fake login or payment pages.
- Smishing uses text messages that pretend to come from delivery firms, banks or even your own CEO.
- Always check the web address preview before opening a link from a QR code, and never enter a password or card details from one.
- Verify any text asking for money, gift cards or logins through a separate, known channel.
- In the UK, forward scam texts to 7726 for free; in the US, report scams to the FTC at ReportFraud.ftc.gov.
Most small businesses have learned to be wary of strange emails. Spam filters catch a lot, and staff have heard the warnings about clicking links. Criminals know this, so they have moved to channels where people's guard is lower. A QR code on a parking meter or in a PDF looks harmless. A text message feels personal and urgent. Both are hard for traditional email security to inspect.
This explainer covers what these scams look like when they target a business rather than a consumer, why they work, and what you can do about them without buying expensive tools. Our guide to spotting and stopping phishing covers email in general; here we focus on the phone in your team's pocket.
What quishing is and how it reaches your business
Quishing is phishing through a QR code. Instead of a clickable link, the victim sees a square pattern and scans it with a phone camera. The phone opens a web page, and that page is controlled by the criminal. Three patterns matter most for businesses.
Fake stickers on real signs
Criminals print QR code stickers and place them over the genuine codes on parking meters, electric vehicle chargers, restaurant tables or posters. The fake code leads to a convincing payment page that collects card details. Staff who park for client visits, drive company vehicles or run a shop with table ordering are all exposed.
QR codes inside emails and attachments
An email says your shared document is waiting, your mailbox password is about to expire or a payroll update needs review, and asks you to scan a QR code. Because the link sits inside an image, some email filters cannot read it. The scan also moves the victim from a protected work laptop to a personal phone, which may have weaker security and no company filtering.
Printed letters and invoices
Some scams arrive by post: a fake fine, a "final notice" from a supplier or a letter claiming to be from a tax office, with a QR code for quick payment. The paper format makes it feel official.
Common mistake
Assuming a QR code is safe because it is printed on something physical or because it appears in a document that looks professional. Anyone can generate a QR code in seconds, and a sticker costs almost nothing. Treat every code as a link from an unknown sender.
What smishing is and why texts work so well
Smishing is phishing by SMS or messaging app. Texts are short, arrive with a buzz and are usually read within moments. There is little room for the clues people look for in email, and the sender name can sometimes be spoofed to look like a company you know. Common business versions include:
- Delivery firms: "Your parcel could not be delivered, pay a small redelivery fee here." Businesses receive many parcels, so this one lands often.
- Banks: "Unusual activity on your business account, verify now," leading to a fake login page or a follow-up call from a fake fraud team.
- The boss: "Hi, it's Sam. I'm in a meeting and can't talk. Can you buy some gift cards for a client and send me the codes?" These texts often come from a new number with an excuse for why the boss's usual number is not being used.
- Suppliers and platforms: messages claiming your ad account, domain or online store has a problem that needs urgent action.
Example
Imagine Tom, the office manager at a small architecture practice, receives a text: "Tom, it's Claire. Stuck in a client meeting. Need you to pay an urgent invoice today, details to follow. Keep it quiet for now." The number is unknown. Tom remembers the practice rule: any payment request by text gets a call to the person's known number. He calls Claire's usual mobile. She is at her desk and has sent no text. The scammer gets nothing, and Tom shares a screenshot with the team so others know to expect similar messages.
Warning signs to teach your team
Quishing and smishing use the same psychology as email phishing, just in a smaller frame. The table below gives your team a quick reference.
| Warning sign | What it looks like | What to do |
|---|---|---|
| Urgency | "Pay within 1 hour," "account suspended today" | Slow down; real deadlines rarely need minutes |
| Secrecy | "Keep this between us," "don't call, I'm busy" | Call the person on a number you already have |
| Odd payment method | Gift cards, crypto, a new bank account | Stop and verify through a separate channel |
| Login request | QR code or link asking for your work password | Go to the service directly by typing its address |
| Strange address | Misspelled brand, extra words, unfamiliar domain ending | Do not open it; report it |
| Sticker on a sign | A QR code that looks stuck on, peeling or on top of another | Use the official app or pay another way |
Practical defenses that cost little or nothing
You will not stop criminals from sending texts or printing stickers. You can make sure your team does not act on them. Here is a set of simple defenses, in order of impact.
- Check the URL preview before opening. Most phone cameras show the web address before you tap it. Teach staff to read it: is it the real company's domain, spelled correctly? If the preview is unclear or shortened, do not open it.
- Never enter credentials from a QR link. Make it a rule: if a QR code leads to a login page for email, banking or any work system, close it. Go to the service by typing the address you know or using the official app.
- Verify money and gift card requests out of band. Any text asking for a payment, a change of bank details or gift cards must be confirmed by calling the person on a number from your own records, never a number in the message.
- Use official apps for parking and charging. Download the operator's app from the official app store and pay there, rather than scanning a code on the street.
- Turn on multi-factor authentication. App-based MFA or passkeys mean a stolen password alone is not enough. Passkeys in particular resist fake login pages.
- Protect company phones. Keep phones updated, use a screen lock and, where you can, manage work phones so they get the same security filtering as laptops.
- Make reporting easy. Give staff one place to send screenshots of suspicious texts and codes. Praise people who report, even if the message was harmless.
Pro tip
If your own business uses QR codes, on menus, invoices or posters, check them regularly for tampering and tell customers the exact web address the code should open. Printing the short domain under the code lets careful customers confirm they are in the right place.
Where to report scam texts and QR codes
Reporting helps phone networks, police and regulators block scams and warn others. It takes a minute.
In the UK
- Forward scam texts to 7726. It is free and helps mobile networks block the sender.
- Forward suspicious emails, including ones with QR codes, to [email protected].
- If you lost money or data, report it to Report Fraud, which replaced Action Fraud on 4 December 2025, online at reportfraud.police.uk or by phone on 0300 123 2040 (England, Wales and Northern Ireland). In Scotland, call Police Scotland on 101.
- The NCSC publishes free guidance on spotting scam messages for small organizations.
In the US
- Report scams and identity theft to the FTC at ReportFraud.ftc.gov.
- Report cyber crime and business losses to the FBI's Internet Crime Complaint Center at ic3.gov.
- CISA publishes free guidance for small businesses on phishing and mobile security.
In every country, if card or bank details were entered, contact your bank or card provider immediately. Speed improves the chance of stopping or recovering a payment. If a work password was entered, change it from a clean device and check the account for unfamiliar sign-ins or new forwarding rules.
Quishing and smishing checklist
- Staff know to check the URL preview before opening any QR code
- A firm rule: never enter passwords or card details from a QR link
- Payment and gift card requests by text are verified by calling a known number
- Parking and charging paid through official apps
- MFA, ideally app-based or passkeys, on email and banking
- Company phones updated, locked and managed where possible
- One easy channel for reporting suspicious texts and codes
- Your own QR codes checked for tampering
- Reporting routes (7726, Report Fraud, FTC, IC3) shared with the team
Frequently asked questions
Can scanning a QR code infect my phone?
The main risk is where the code takes you, not the scan itself. A malicious page may ask for a password or card details, or try to persuade you to download an app. Keep your phone updated, check the address before opening it and never install apps from links in QR codes or texts.
Why do scammers put QR codes in emails instead of links?
A code inside an image can be harder for some email filters to inspect, and scanning it moves you from a protected work computer to a phone that may have less protection. That is why a QR code asking you to log in is a strong warning sign.
Should we stop using QR codes in our own business?
No, they are useful. Just check printed codes regularly for stickers placed over them, use a short and recognizable web address, and print that address near the code so customers can confirm it.
What if an employee already entered their password?
Change the password straight away from a clean device, sign out all active sessions, check for new mailbox forwarding rules or unfamiliar sign-ins and confirm MFA is on. Thank the employee for reporting quickly, because that speed limits the damage.
Related reading
The bottom line
QR code and SMS scams work because they catch people away from their desks, in a hurry and outside the protection of email filters. The defense is a handful of habits: read the address before opening, never log in from a QR link, verify money requests through a known number and report anything odd. Teach those habits, make reporting easy, and your team will be much harder to fool, wherever the message arrives.
