Your employee receives an email saying a Microsoft 365 password is expiring. Instead of a normal link, the message contains a QR code. Scanning it opens a convincing sign-in page on a phone, where the smaller screen makes the address harder to inspect.
This technique is often called QR-code phishing or “quishing.” It is effective because it moves the victim away from the protected business computer and onto a personal mobile device.
Why the QR code feels trustworthy
Restaurants, parking systems and payment apps have trained us to scan QR codes quickly. In an email, the image may also avoid some link-scanning controls. The destination can still lead to a fake Microsoft, bank, payroll or document-sharing page.
Urgency is the hook
Common messages claim that a password expires today, a payment failed, voicemail is waiting or a document requires immediate review. The sender wants the employee to act before verifying the request.
Use another path to verify
Do not scan the code in the message. Open the official service through a saved bookmark or known app. If the account truly needs attention, the same notice should appear there. For an internal request, call the coworker using a known number rather than replying to the suspicious message.
MFA is essential, but not the whole answer
Multi-factor authentication blocks many stolen-password attacks. More advanced phishing can attempt to steal an authenticated session or convince a user to approve an unexpected prompt. Employees should never approve an MFA request they did not initiate.
Protect the person who handles money
Bookkeepers, owners and office managers receive invoices, wire instructions and payroll requests. Create a verification rule for payment changes: confirm through a second channel using contact information already on file.
If someone entered a password
Report it immediately. Change the password from a trusted device, sign out active sessions, review forwarding rules and check whether MFA settings changed. Waiting to see what happens gives an attacker more time.
Hi-Tek Solutions helps small businesses review Microsoft 365 security, employee access, antivirus protection and recovery plans. Our Los Angeles County business IT support is designed for offices that need practical protection without an enterprise-sized IT department.
Business Security Special: Save 15%
Mention this article and receive 15% off any one Hi-Tek Solutions service through October 4, 2026. One discounted service per customer. Cannot be combined with another promotion. Parts, licenses and subscription products are not discounted.
Contact Hi-Tek Solutions or call 562-361-8034. Walk-ins are welcome—no appointment is required.
Hi-Tek Solutions · 562-361-8034
Article: https://hitek-solutions.com/qr-code-phishing-small-business-los-angeles/