Stop before entering credentials or payment details. Check that the domain is the one you expected, compare it with a trusted source, and leave if anything looks off. A safer approach is to search for the intended site independently or open it from a saved, verified bookmark rather than trusting the scanned destination.
What to check before you trust the destination
The key judgment is whether the scanned page matches the place you expected to visit, not whether the QR code itself looked legitimate. A QR code can be copied from a poster, email, receipt, or screen and redirected without changing the printed code. The practical test is simple: verify the domain, compare it with a known source, and treat any mismatch as a stop signal.
If the destination is a login page, be especially strict about the full domain, subdomain, and sign-in method. A convincing page can still be the wrong service, a lookalike domain, or a phishing relay designed to capture credentials after the scan. Use a trusted bookmark, a typed address, or the organisation’s own site search rather than following the scanned link when there is any doubt.
NHIMG’s QR Code Phishing (Quishing) Guide covers the common QR scam patterns that make this check necessary, including QR-based login traps and payment lures.
Why QR-linked login pages are risky
Unexpected QR destinations are risky because they move the user from a visual object into a web flow that is easy to spoof and hard to inspect quickly on a phone. The attacker’s goal is usually to create urgency, shorten the time available for verification, and capture something valuable before the user notices the mismatch. That may be a password, a one-time code, or a payment action.
Even when the page is not obviously malicious, the wrong destination can still expose the user to credential harvesting, session capture, or a fraudulent payment step. The danger is not limited to the first click. If the page prompts for a second factor, a verification code, or a payment confirmation, the user may be validating the attacker’s workflow rather than their own account.
Top 10 phishing techniques is useful context here because QR lures sit alongside other credential-harvesting methods that rely on urgency and trust abuse.
MITRE ATT&CK T1598 Phishing for Information maps the common collection patterns behind these pages, including link-based and QR-based credential capture.
How to respond safely in the moment
The safest response is to break the flow before any sensitive entry. Close the page, do not reuse the scanned destination, and navigate to the intended service by a path you already trust. If the QR code came from a workplace poster, invoice, event badge, package label, or payment request, independently confirm the URL or app through another channel before continuing.
When the QR code is part of a sign-in or cross-device login flow, treat it as a high-trust action that deserves extra verification. The right question is not “Does the page look familiar?” but “Can I prove this is the exact service and exact login path I intended to use?” If you cannot answer that quickly, stop and re-enter the destination yourself.
Cross-Device Flow Security Guide explains why QR-based sign-in flows need stronger verification than ordinary browsing, especially when a page is asking you to approve access from another device.
Passkeys for Everyone Guide is relevant when the QR page is trying to complete a login, because users should only continue through a passkey flow they intentionally started on the trusted service.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-63, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP API Security Top 10 | API2 — Broken Authentication | Unexpected QR login pages can capture or abuse credentials. |
| Recommendation — Verify that QR login endpoints authenticate only the intended user and flow. | ||
| MITRE ATT&CK | T1566 — Phishing | QR lures are a phishing delivery path for credential theft. |
| Recommendation — Detect and block QR-based phishing delivery before users reach a login page. | ||
| NIST SP 800-63 | Digital Identity Guidelines | The scenario hinges on trustworthy login and phishing-resistant authentication decisions. |
| Recommendation — Use phishing-resistant authentication and validate the sign-in source before entry. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication, and Access Control | Users must verify access paths before entering credentials on a destination page. |
| Recommendation — Enforce verified access paths before credentials are accepted. | ||
| CIS Controls v8 | CIS-14 — Security Awareness and Skills Training | Users need clear training on QR destination verification and stop conditions. |
| Recommendation — Teach users to verify QR destinations before entering sensitive information. | ||
Practitioner Guidance
What to verify: Train users to check the exact domain, not just the logo, page layout, or product name. A legitimate QR flow should resolve to the expected organisation and the expected path, and any unexpected redirect, extra login prompt, or unfamiliar host should be treated as a failure condition.
Decision rule: If the QR destination asks for credentials, payment data, or MFA approval and it was not opened from a trusted source you already intended to use, stop and re-open the site manually. The safest user behaviour is to switch to a verified bookmark or a known app entry point rather than trying to rescue the scanned session.
Practitioner takeaway: The critical control is not scanning safely, it is refusing to trust an unverified destination after the scan, especially when the page can collect credentials or trigger an approval.
Related resources from NHI Mgmt Group
- What should teams do when a QR code leads to a suspicious login flow?
- What happens when users enter a malicious device code on a trusted login page?
- What happens when a spoofed email leads users to a fake login page?
- What happens when an executive scans a malicious QR code and enters credentials on the fake login page?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org