Can You Spot the Phish? QR Code Quiz

A fictional payroll email hides four QR-code red flags. Count them before you scroll, then check the reveal.

A QR code in an email asks for a quick decision. Point your phone, scan, and fix the problem. That speed is the point. Scammers send QR codes by email and text with a made-up reason to scan, often routine-sounding account work.

This quiz is a safe way to practice. The email below is fictional. Northbridge Payroll is a made-up company, invented for this quiz. There is no real company behind it and no real code to scan. The flags in it are real, following the pattern the Federal Trade Commission describes for QR code scams.

For more practice, see the briefing Can You Spot the Smish? Package Text Quiz and the briefing Spot the phish before you touch the bait. This time the bait is a code, not a link you can read.

The Email: Read It Before You Scroll

The message arrives in your inbox like this:

Northbridge Payroll, the account problem, the deadline, and the SCAN TO VERIFY instruction are all fiction. None of it is a real message from a real company.

Pause here. How many flags can you find? There are four. Hold your number.

The 4 QR Code Red Flags, Revealed

Flag 1: It Arrived Unexpected and Unsolicited

The first flag is the arrival itself. You were not expecting this email, you did not ask for a code, and now it wants you to scan one to fix an account problem.

The FTC advises not scanning a QR code in an email or text you were not expecting. That test comes first, before wording or design. The fictional email fails it at the inbox, before the code is even in view. Leave it unscanned while you check the claim another way.

Flag 2: The Code Hides Where It Leads

A written link shows its destination in text. You can read it and spot something off. A QR code shows a pattern of squares. You learn the address only by scanning it.

That hidden destination is the risk. A scammer's code can lead to a spoofed site that looks real. If you sign in there, what you entered can go to the scammer. The code gave you no chance to judge the destination first.

The FTC remedy is to check the address before you open it. If your phone shows a URL preview after a scan, read it before you tap. Check a familiar-looking address for misspellings or a switched letter.

Flag 3: Urgency and a Threat Do the Pushing

The third flag is pressure. The fictional email says there is a problem with your payroll account, gives you 24 hours to scan and verify, and warns your account will be locked if you do not. That deadline and lock warning are part of the fiction, invented to show the pattern in one place.

The pattern is real. Scammers use account-problem and suspicious-activity stories to create urgency, so the victim scans without thinking. The FTC singles out messages that urge immediate action. Treat the deadline as part of the lure — a reason to slow down, not to scan faster.

Flag 4: It Tells You to Verify by Scanning Instead of Going Direct

The fourth flag is the instruction itself: SCAN TO VERIFY. The fictional email makes scanning the only route to fix the supposed problem, keeping you inside the message on the sender's terms.

The direct route looks different. If a message like this might be legitimate, the FTC advises contacting the company using a phone number or website you know is real. Go to the real site or open the real app yourself. Do not use the code in the message to get there. Going direct breaks the chain: unexpected arrival, hidden destination, urgent scan.

What to Do When a QR Code Arrives in Email or Text

Do not scan a QR code in a message you were not expecting. Leave it alone and decide, away from the message, whether the claim could be real.

If it might be real, go direct. Contact the company through a phone number or website you know is real. Open the official site or app yourself and check your account there. If there is no problem there, the email was the problem.

If you have already scanned, stop before you enter anything. Inspect the URL preview before opening the page, and check a familiar-looking address for misspellings or a switched letter.

Two habits limit the damage if a bad page catches you. Keep your phone operating system updated. Protect accounts with strong passwords and multi-factor authentication. They do not make a suspicious code safe. They make accounts harder to take over.

How many flags did you catch? Four was the full count: an unexpected code, a hidden destination, urgency with a threat, and a verify-by-scan instruction instead of the direct route. The next real message will not label itself fictional. The flags will still be there.

Sources: FTC — Scammers hide harmful links in QR codes to steal your information ↗