Only scan QR codes from sources you already know and trust (your firm, known vendors, official apps or websites).

After you scan, always check the website address before tapping: make sure the domain is spelled correctly, uses HTTPS, and matches the organization you expect.

Never enter your work password, MFA code, or payment details on a site opened from a QR code unless you are absolutely certain it is legitimate.

When in doubt, close it and go to the site using your browser or the official app.

Be extra cautious with QR codes on stickers, posters, flyers, parking tickets, or in unexpected emails or text messages—these are common scam methods.

If you scan a QR code and something looks off, do not proceed and report it to IT/security immediately.