Outlook QR Code Scam: What It Is and What to Do
A QR code in an Outlook or Microsoft 365 message is a common quishing tactic. If the code asked you to re-authenticate, update your password, open a shared file, or fix a mailbox problem, verify through Microsoft directly before taking another step.
Common Outlook QR code scams
- Fake password-expiration notices: an email says your Outlook password expires today and the QR code opens a fake Microsoft login page.
- Microsoft 365 re-authentication lures: the message claims your session expired or your mailbox storage needs attention.
- Calendar-invite QR codes: an invite uses a QR image to reach a fake meeting, document, or login portal.
- Work-account quishing: the QR sends you to a page that captures credentials, then attackers use the account for invoice fraud or more phishing.
This overlaps with the broader Microsoft QR code scam, but Outlook users face an extra risk: attackers can add forwarding rules and silently watch future email.
What to do if you scanned it
- If you did not enter anything: close the page and report the message in Outlook. The scan alone is usually not enough to compromise your account.
- If you entered your password: go directly to account.microsoft.com, change your password, and sign out of sessions you do not recognize.
- Check Outlook rules: review forwarding, inbox rules, delegated mailbox access, auto-replies, and connected apps.
- If this was a work account: contact IT or security immediately. They can revoke sessions and check sign-in logs faster than you can from the user portal.
Safer rule for Outlook QR codes
Treat any QR code in an unexpected Outlook message like a link you cannot see. If the message claims to be from Microsoft, your employer, a vendor, or a bank, go to the official portal by typing the address yourself or use the app you already trust.
For a workplace-wide approach, read the guide to protecting employees from QR code scams.
Frequently asked questions
Why do Outlook phishing emails use QR codes?
QR codes can bypass security tools that scan visible links in email. The message shows an image, then your phone opens the destination outside the corporate email environment.
What should I do if I entered my Outlook password?
Change the password from a trusted device, revoke active sessions, enable multi-factor authentication, and check mail forwarding rules. If it is a work account, notify IT immediately.
Are all QR codes in Microsoft 365 messages scams?
No, but unsolicited QR codes in email should be treated as untrusted. Verify through the official Microsoft 365 portal or your IT team before scanning.
Can an Outlook QR code compromise my work account?
It can if it leads to a fake Microsoft login page and you submit credentials or approve a session prompt. The QR code itself is only the delivery method.
Preview QR destinations before Outlook sends you there
QRsafer checks the destination URL before a QR code opens in your browser.