• Only approve sign-ins, codes, or device links you started yourself.
• Check the real web address before entering anything.
• If you slip, stop and report it right away.

In the first half of Part Three, we looked at why criminals love QR codes and the everyday places they hide: conference signs, restaurant menus, parking meters, and too-good-to-be-true giveaways. Now let’s look at a sneakier variation, and at the habits that make all of them much less exciting.

The QR code that doesn’t take you anywhere. It lets someone in.

Most QR scams send you somewhere bad. A sneakier family sends you nowhere at all; instead, your scan quietly hands a stranger a key. Messaging apps such as WhatsApp and Signal let you use your account on a computer by scanning a QR code with your phone, a feature called linked devices. Scan the wrong code, and the “computer” you just linked belongs to someone who can now read your chats.

In May 2026, Switzerland’s National Cyber Security Centre described a WhatsApp scam that arrives from a friend’s already-hijacked account, asking you to vote for them in an online contest. The voting page then displays a QR code with helpful instructions: open WhatsApp, go to Linked devices, and scan. Anyone who obliges hands over their account. The fix is pleasantly boring: in WhatsApp, open Settings, then Linked devices, and log out of anything you don’t recognize.

A workplace cousin of this trick made headlines in September. Device code sign-in is a legitimate feature that lets you log in to something without a keyboard, such as a smart TV, by typing a short code on another device. A criminal service called EvilTokens started those sign-ins itself, then talked people into typing the code on Microsoft’s genuine sign-in page, which handed the criminals access to their mailboxes. Microsoft says the service compromised more than 12,000 inboxes at over 10,000 organizations. Note the plot twist: the website was real. The request was the scam.

Now the ending we like. On September 22, Microsoft announced it had disrupted EvilTokens, and London’s Metropolitan Police had arrested two men connected to the service. Crime pays, right up until it very much doesn’t.

One rule covers this whole family: only approve a sign-in, device link, or code that you started yourself, for a reason you understand.

Read the destination and the request

The URL is the web address. The domain name identifies the site within that address. Check it before opening a code’s link, then check the address displayed by the browser before entering information. One address can forward you to another.

For example, these two made-up addresses point to different sites:

The second belongs under signin-help.example. The familiar-looking conference.example at the front does not make it the conference’s site. These are deliberately fictional addresses, but the trick is real: familiar words can appear inside an unfamiliar destination.

If an address is shortened, cut off, or simply too confusing to assess, use another route. Open an app you already know, use a saved bookmark, or type a verified address yourself. You are allowed to decline a puzzle.

And HTTPS at the beginning of an address does not certify honesty. It means the connection uses encryption, which scrambles information as it travels. The FTC specifically warns that scammers use encrypted sites too. A password can be delivered securely to entirely the wrong person.

Nine habits that make QR codes much less exciting

1. Check the setting before scanning. Was the code expected? Does the request fit what you are doing? Look for pasted-over codes or suspicious replacement signs, and ask staff when something seems wrong.

2. Use your phone’s built-in camera or scanner. You generally do not need a separate QR-reading app. If you need an event or parking app, find it independently in your phone’s official app store and verify the publisher.

3. Pause at the address preview. Check the actual destination, including spelling, then check again before entering information. A logo and the word “secure” are easy to copy. If you cannot verify the address, use a known route instead.

4. Choose an independent route for payments and sign-ins. Open the official app yourself or use a verified website. If you need to call, obtain the number independently; a number printed beside a suspicious code can belong to the same scammer.

5. Treat unexpected QR codes in messages cautiously. An email about a locked account or urgent payment deserves the same skepticism whether it contains a link or a square. Scanning with a personal phone can move the task away from your employer’s security protections.

6. Question requests for access. Stop if a menu, agenda, or prize asks for an unrelated account password, a one-time sign-in code, or approval to connect a device. Verify what the request will authorize before proceeding.

7. Check your linked devices now and then. In WhatsApp, Signal, and your work accounts, review which computers and devices are signed in, and remove anything you don’t recognize. It takes thirty seconds and is oddly satisfying.

8. Keep your phone and browser updated, and strengthen account security. Use unique passwords and multifactor authentication, which adds another proof of identity when you sign in. Where available, use a passkey: a digital key tied to a particular site, usually unlocked with your face, fingerprint, or device unlock code. Passkeys resist fake-site phishing, though you must still scrutinize requests to grant access.

9. Report suspicious codes promptly. Tell the venue, restaurant, parking operator, or your IT/security team. Preserve the message or a photo of the sign and its location when safe. One report can help stop the next person from encountering the same trap.

Already scanned something suspicious

Start by stopping. Close the page and do not continue through its instructions. Then respond to what actually happened.

• You only previewed the address or opened the page: This alone does not prove a compromise. Avoid further interaction, keep your device updated, and report it to IT/security if a work device or account was involved. Mention any download or unexpected permission request.
• You typed a password, even if you never pressed submit: Treat it as exposed; websites can capture information before submission. Change it promptly through the genuine service, using a device you trust, and anywhere else you reused it. For a work account, notify IT/security immediately.
• You entered a sign-in code, approved a login, or linked a device: Tell IT/security or the service’s support team exactly what you approved. Existing account access may need to be revoked; changing a password alone may not resolve it.
• You entered card details or paid: Contact the card issuer, bank, or payment service immediately through its official app or a known number, such as the one on your card. Ask about blocking further misuse and recovering the payment, and review transactions. Recovery is not guaranteed, but prompt reporting matters.
• You installed software or granted unusual permissions: Stop using that device for sensitive tasks and get help from IT/security or the device manufacturer. Do not follow a pop-up offering to “clean” the problem or erase a work device before IT can assess it.

For a useful report, record the time, location, web address, and what you did. Keep the original message or a photo if available, without revisiting the suspicious site. In the United States, report fraud at ReportFraud.ftc.gov or IC3.gov.

You do not need to prove an attack succeeded before reporting it. “I scanned this and then it asked for my work password” is useful information. Silence gives the scam more time; speaking up gives people a chance to help.

Keep the convenience and the curiosity

QR codes are useful. We can keep the quick menus, easy check-ins, and convenient payments while asking two sensible questions: Where is this taking me, and why does it want that information or permission? For the website codes we encounter every day, remember: a QR code is simply a link you cannot inspect at a glance.

The square can save you some typing. It has not earned the right to do your thinking.

Thank you for a terrific Cybersecurity Awareness Month

This is the final article of this year’s Cybersecurity Awareness Month. If you keep only a few ideas from this series, make them these:

• Know what the Internet knows about you. Your name, role, photos, and posts add up to a public footprint that scammers mine to sound convincing. Look at it now and then, and trim what doesn’t need to be out there.
• Pause before you click, tap, or scan. Urgency, secrecy, flattery, and offers that are too good to be true are the classic moves of social engineering. Once you recognize the moves, the costume stops mattering.
• Treat AI as a tool, not a monster or a miracle. It isn’t the bad guy, and nobody wins a prize for handing it the keys first. Learn it, experiment with approved tools, and keep asking good questions.
• Stay curious and stay alert. The best security instinct is wanting to know how things work and noticing when something doesn’t quite fit.