Security & privacy
QR codes in security awareness training
Simulated QR phishing works like simulated email phishing, place codes on posters, mail inserts or fake notices, measure who scans, and land everyone on a short, blame-free teaching page. Never harvest real credentials. Static codes with UTM parameters and one code per placement give you full measurement with free tooling.
Why QR belongs in the programme
Most awareness programmes still train two reflexes — hover over links, distrust attachments — and neither transfers to a poster in the lift. QR phishing exploits a channel with no hover state and no filter: quishing moves the victim to a personal phone outside corporate protection, and codes in images sail past email filters that would catch the same URL as text. If your last simulation was email-only, your measured resilience has a blind spot exactly where attackers are aiming.
Designing a simulated QR campaign
Simulate the placements real attackers use:
| Vector | Simulates |
|---|---|
| Poster drop in kitchens, lifts, lobbies | Malicious flyer on the premises |
| Mail insert or desk drop | Codes arriving by post |
| Email with a code in an attached PDF | The classic quishing email |
| Fake notice on the car park (own premises only) | Parking-scam stickers |
Generate one code per placement with the bulk generator — when the "free coffee" poster in the lift outperforms the mail insert three to one, you have learned where your people are least suspicious, which is the entire point of the exercise.
Measurement without harvesting
Static codes plus URL parameters give complete measurement with no phishing platform:
https://training.example.com/lp?utm_source=qr&utm_campaign=sim-q3&utm_content=lift-poster
Tag each code with a UTM parameter per placement — the technique is the ordinary one from adding UTM parameters to a QR code — and your existing analytics shows the funnel: scans, then click-throughs on the landing page, then attempted form submissions.
The ethical line sits at that last step, and it is bright: a simulation never collects real credentials. If the page includes a login form for realism, it must accept any input, transmit and store nothing, and flip to the reveal on submission. You are measuring the decision to type, not the password. Punishing individuals is equally out — publish aggregate results, coach privately.
The teachable-moment page
The reveal page is the highest-value screen in the programme: the lesson arrives five seconds after the mistake, on the device where it happened. Keep it short, blame-free and concrete — congratulate the curiosity, name the exercise, then teach the three checks from how to check a code before opening: read the domain on the preview banner, distrust shorteners, never enter credentials on a page you reached by scanning. One screen, no video, no quiz gate.
Ground rules
- Sign-off first. Leadership, HR and works-council approval where applicable; staff informed in general terms that simulations happen.
- Contain the blast radius. Physical drops stay on your own premises so visitors and passers-by are not phished by proxy — a fake parking notice on a public street is an incident, not a simulation.
- Verify before deploying. A simulation code that fails to scan measures nothing; run each one through a decode check first.
- Close the loop. Debrief openly with aggregate numbers, repeat quarterly, and fold findings into the enterprise QR policy.
FAQ
How do you run a QR phishing simulation?
Place uniquely tagged codes where attackers would — posters, mail inserts, email PDFs — route every scan to a blame-free teaching page, and measure scans and click-throughs per placement through ordinary analytics. Never collect real credentials at any step.
What should a QR phishing landing page say?
That this was a training exercise, without blame, followed by the three habits that would have caught it: read the domain on the scanner's preview banner, distrust shortened links, and never enter credentials on a page reached by scanning.
Is it ethical to test employees with fake QR codes?
Yes, with the same guardrails as email simulations: leadership and HR sign-off, staff aware that simulations occur, no real credential collection, no individual punishment, and placements confined to your own premises.
Do simulated phishing tests collect passwords?
They must not. A realistic form may be shown, but it should accept anything, store nothing and immediately reveal the exercise. The metric is the attempt to submit, never the submitted value.
Try it — free, no signup
Related
- Are QR codes safe? — Scanning a QR code is safe in itself — it decodes text and nothing else. The risk is entirely in what you do next. A code cannot install software, dial,…
- Quishing: QR code phishing explained — Quishing is phishing delivered by QR code. It works for two structural reasons: a human cannot read a URL from a pattern before scanning it, and email…
- QR codes in phishing emails — Why phishers put QR codes in email: the image slips past URL filters, and the scan moves you to an unmanaged phone. The lures, the journey, the defences.
- An enterprise QR code policy you can adopt — An adoptable enterprise QR policy — approved generators, own-domain rules, design standards, a code registry, audit cadence and an incident playbook.