QR Code Phishing Checklist for Small Business Teams
A QR code can be useful at a checkout counter, on a delivery notice, or in a staff handout. It should not become a shortcut around your normal checks for sign-ins, payments, and software installation. For a small business, the important question is not whether every code is dangerous. It is whether employees know how to verify an unexpected request and who to contact when something feels wrong.
Use this checklist with office staff, store supervisors, and anyone who handles business accounts on a phone. The reporting template below gives your IT contact useful facts without asking employees to investigate a suspicious website themselves.
Recognize the request before opening the destination
QR-code phishing, sometimes called quishing, uses a scannable code to send someone toward a deceptive destination. The Federal Trade Commission warns that unexpected codes can lead to imitation websites that collect entered information. It recommends checking the destination and independently contacting the organization behind an unexpected request. Read the FTC guidance on QR-code scams.
For a workplace, consider the whole request. Did your manager announce a new process? Were you expecting this delivery or invoice? Does the request ask you to leave a familiar business application and sign in somewhere else? A recognizable logo does not answer those questions.
Imagine an employee receives a printed notice saying that payroll access will expire unless they scan a code immediately. This is an illustrative training scenario, not a reported client incident. The safe next step is to contact the payroll administrator through an existing channel, rather than following the notice.
Use a short verification routine
Build these checks into the moment before someone opens a code's destination:
Confirm the purpose with the person or organization responsible for the request.
Use a saved bookmark, an established business application, or a contact number already in your records when the request involves account access or payment.
If your camera displays a destination preview, inspect it before opening. If the destination is unclear, stop and ask for help.
Treat an unexpected request to install software, enter a password, approve access, or provide payment details as a reason to verify independently.
Check physical signs for a replacement sticker or other visible alteration.
The FBI guidance on QR-code tampering specifically addresses codes replaced with malicious versions and advises checking for stickers over original codes. It also recommends getting applications from the phone's app store instead of downloading through a QR code.
Do not turn this routine into a technical test employees must pass alone. “I cannot verify this” should be enough to pause the action. Give staff a known reporting contact before a busy shift, not only after an incident.
If someone already interacted with the code
Ask what happened, without blame. Opening a destination, entering credentials, authorizing access, and installing software are different events. Your IT contact needs that distinction to decide the next step.
A page opened but nothing was submitted
Stop interacting with the page and report where the code came from. Do not reopen it to collect more details. Record the approximate time and device used, and preserve the original message or a photograph of the physical notice if available. A scan alone is not proof that an account has been compromised, but uncertainty is worth reporting.
Credentials or an approval were supplied
Contact your IT or account administrator promptly through a known channel. Tell them which business account was involved and whether an authentication prompt was approved. Never include a password or one-time code in the report. Have the administrator guide account recovery and review; avoid changing settings through links in the suspicious message.
Software was installed or money was sent
Stop using the affected device for sensitive work and contact your IT team for containment instructions. Do not attempt a factory reset before they assess what evidence is needed. If a payment was involved, notify the business's payment owner immediately so they can contact the appropriate provider using established details. Keep transaction references in the approved incident channel, not in a group chat.
These categories help employees report accurately. They do not replace an incident-response plan or establish that a device is safe.
Copyable QR incident report template
Save this worksheet in your existing support process. Complete what you know and mark uncertain details as unknown. Do not scan again simply to fill an empty field.
Reporter and safe callback method:
Date, approximate time, and business location:
Where the code appeared: email, text, printed sign, package, or another source:
What the request claimed to be for:
Device used and whether it is business-owned or personal:
Interaction reached: not scanned, preview seen, page opened, information submitted, access approved, software installed, or payment made:
Business account affected, without passwords or security codes:
Original message or notice available for the IT contact:
Actions already taken and person notified:
Assigned incident owner and next update time:
For example: “Front desk, 10:20 a.m.; printed delivery notice; page opened on a work phone; no details entered; supervisor notified; original notice retained.” This original example shows the level of detail to aim for. It does not need speculation about who created the code.
Keep your own business QR codes accountable
Maintain a short register of codes your business intentionally displays. Record each sign's location, purpose, expected destination, owner, and last review date. Include codes used for customer feedback, appointment booking, menus, or guest instructions.
Choose someone to check physical displays as part of opening or routine site checks. When a destination changes, update the register and replace old printed material. Keep a readable alternative address or staff-assisted option available so a customer does not have to scan an unfamiliar code.
For a business with several locations, assign a local contact who can photograph and verify a sign. If equipment or site checks need hands-on assistance, on-site IT support can help coordinate that work.
Give employees a clear reporting path
A useful training exercise ends with an action: staff should know the approved contact, how to reach them from another device, and what information to record. Review that path when employees join, responsibilities change, or a new customer-facing code is introduced.
Sosa Solutions NYC provides business cybersecurity services, including employee awareness and incident-response support. Discuss how QR-code reporting fits into your existing security procedures rather than creating a separate process nobody maintains.
Comments