Is a QR code in an email from my bank or payroll provider safe to scan?
QR codes in unsolicited emails from financial institutions are a growing phishing technique. Banks and payroll providers rarely need you to scan a QR code by email — verify first.
Last reviewed: 1 August 2026
Explanation
QR code phishing, sometimes called quishing, exploits the fact that email security tools scan text links but often cannot inspect QR code images. A fraudulent email mimics your bank, payroll provider, or HR system and asks you to scan a QR code to verify your account, update your banking details, or claim a payment. The code redirects to a fake login page that captures your credentials.
The QR step serves the attacker twice. It bypasses filters that would have flagged the same URL as a text link, and it moves you from your work computer — with its security controls and monitoring — onto your personal phone, which usually has neither. A small screen also makes the fake page's address harder to inspect. Payroll-themed versions are particularly effective in workplaces because 'scan to view your updated pay details' arrives with built-in urgency, and captured credentials are then used to redirect salary payments.
Your real bank sends you to your app or known website — it does not typically embed QR codes for account management in routine emails, and neither do legitimate HR systems. If you receive an unexpected email with a QR code from a financial entity, do not scan it; navigate directly to the institution's website or app to check whether any action is genuinely required, and report the email to your IT team or the institution's phishing address so others receiving the same campaign are protected.
Common red flags
- Unexpected email from a financial institution containing a QR code
- Email claims urgent action is needed or your account will be frozen
- QR code destination URL uses a different domain from the institution
- Sender email address differs subtly from the official domain
What to do now
- Do not scan the QR code
- Log in to your bank or payroll portal directly to check for any genuine alerts
- Forward the phishing email to your institution's abuse address
- Report to your national cyber crime reporting service
Frequently asked questions
Do banks ever legitimately send QR codes by email?
Some banks use QR codes for specific verified in-app actions, but they will direct you to open your existing app — not to scan an email QR code to access your account from scratch.
Why do quishing emails ask me to scan with my phone specifically?
Because your phone likely sits outside your employer's security stack — no filtering, no monitoring, and a small screen where a fake URL is hard to inspect. Moving you to the weakest device is the point of the QR code.
I scanned the code and logged in before realising. What should I do?
Change that password immediately, enable two-factor authentication, and alert the real institution — for payroll systems, tell HR to check whether your bank details were changed. If you reused the password elsewhere, change it there too.