Nano-lesson · usually takes 2–3 minutes

Dangerous attachments & QR codes

When a file or QR code is a trap — and what to do about it.

Get started →

Two everyday traps

A sticker with a QR code on the car park payment machine. An unexpected .zip file with an “invoice”. Both can hide malware — malicious software — or a fake login page.

Next →

Watch out for

• Unexpected Office files that ask you to “enable macros” — a macro is a small piece of built-in code that can install malicious software. Don't do it.
• .zip / .html / .iso files from unknown senders.
• QR codes in emails, on posters — or stuck over the genuine code on, say, a car park payment machine. You can't tell just by looking where a QR code leads.

Next →

Where does the QR code lead?

→

The QR code leads to: https://www.royalmail.com.track-parcel.info/track

A QR code can lead to a domain like track-parcel.info — not royalmail.com. You can't see that with the naked eye; always check the address once the page opens, before you log in.

Next →

Do

only open files you're expecting. Have you scanned a QR code? Check the address at the top before you type anything. In doubt? Ask IT.

Next →

Remember

💡

“Enable content/macros” is almost always a trap.

Next →

What the research says

QR phishing is growing rapidly — executives are targeted 42× more often than others — precisely because the QR code moves you onto a private mobile device and bypasses mail filters, and anyone with a mobile in their pocket is a possible target. Well-designed browser warnings, on the other hand, stop 75–90% of users — as long as they don't click straight past them.

Abnormal Security 2024 · Akhawe & Felt, USENIX Security 2013.

Next →

Question 1 of 3

You open an emailed “invoice” in Word. A yellow bar at the top says: “Enable content to view the document”. What do you do?

Check that the antivirus is running, then enable it Close the file and ask IT if you weren't expecting it Click “Enable content” — otherwise you can't see the invoice, can you

Question 2 of 3

You scan the QR code on a car park payment machine. The page asks for your card details — but the address at the top is pay-parking.info. What do you do?

Only pay for one hour — that keeps the risk low Pay — the code was on the machine itself, after all Stop — the code may be stuck over the genuine one; pay via the app or the machine instead

Question 3 of 3

A company you've never dealt with sends “Invoice_40912.zip”. What's the safest thing to do?

Open it to see whether the invoice even concerns your company Report the email without opening the file Open it on your phone instead — surely a virus can't run there

Well done!

You've completed one of the foundation courses — the ones everyone gets for free.

With a free login:

• Your points, progress and course certificate are saved.
• You get courses tailored to your role — not just the foundation courses.
• We send training exactly when you need it — for example, as a follow-up to a phishing test.

Create a free login → ← See the other courses