QR codes in emails and PDFs: what to check
A QR code in an email hides the web address, so it can slip past filters and past you. Treat it like any unknown link.
Verify › Guides › QR codes in emails and PDFs: what to check · Last updated 19/10/2026
Why scammers put QR codes in emails
Email security tools often look for risky links in the text. A link hidden inside a picture of a QR code is harder for them to read, and harder for you to read too. Scammers also use them to move you from a work computer to your phone, which may have fewer protections.
What to check first
- Were you expecting this email, and does it come from an address you recognise?
- Does it create urgency, such as an account locked or a payment due?
- Is the QR code the only way offered to log in, pay or confirm something?
- Does the sender, wording or branding feel slightly off?
Safer ways to do it
- Do not scan it straight away.
- Go to the organisation's website or app by typing the address yourself, and log in there.
- Contact the sender using details you have found independently if you are unsure.
- If you do want to look, check where the code leads before you enter anything.
Check a QR code with Verify
Open Verify and use the QR check to see where a code leads before you visit it. You get a traffic light and a plain-English reason. Verify gives guidance only and cannot guarantee a destination is genuine.
Report it
- Forward suspicious emails to report@phishing.gov.uk.
- Forward scam texts to 7726.
- If you entered details or paid, contact your bank straight away.
- Report fraud to the Report Fraud service in England, Wales and Northern Ireland, or call Police Scotland on 101.
Check a QR code, link or phone number
Common questions
Is a QR code in an email a scam?
Not always, but it is a link you cannot read. Treat it like any unknown link and check it first.
Why do scammers use QR codes in PDFs?
The web address is hidden inside an image, which can make it harder for email filters and for you to spot.
What should I do if I scanned one?
Do not enter any details. If you did, contact your bank and report it as above.
More guides
- How to check if a QR code is safe
- How to spot a scam link
- Is this phone number a scam?
- How to avoid parking QR code scams
- Got a missed delivery text? What to do
Follow Verify for scam-spotting tips: LinkedIn · Facebook
Verify gives guidance only and cannot guarantee that any link, code or number is safe. If something feels wrong, trust that feeling and check another way.