CyberCQR Thinking · Data protection
Your DLP was built for files. Your data can leave as a picture.
QR codes have trained everyone to scan first and think later. Criminals use that habit in car parks and inboxes, and an insider can use the same square to carry client data out of the building on a phone. Most firms' controls were never built to see either.
Summary
The point for boards. Incoming email is no longer the main gap: Microsoft 365 now checks QR codes in the messages it receives. The gap is everywhere else: the car park, the poster, the personal phone, and the screen an insider can photograph. A single QR code can carry the key terms of a contract or a few dozen client contacts, and making one in Word leaves nothing for a file-based data loss prevention (DLP) tool to inspect. Treat a QR code as a way data moves, not just as a link.
We put QR codes around an office. A quarter of the staff scanned them.
At a firm of about 600 staff, we placed QR codes around the office with almost nothing written beside them: no logo, no explanation, no reason to scan. Each one led to a simple page that asked for a name and work email address. In one week there were about 150 scans. Around half of those people typed in their real details.
Nobody was careless by their own standards. For years they have been taught that a QR code is how you get things done: a restaurant menu, a parking payment, a parcel redelivery, a hospital check-in. The square carries no warning signs, and the phone opens the link before anyone has asked who put it there. That habit is exactly what criminals rely on.
If 75 people will hand over a work email address to an unexplained square on an office wall, the training they have had has not changed the habit.
The car park is where the habit is exploited most
Action Fraud, the national fraud reporting service at the time (since replaced by Report Fraud), received 784 reports of quishing (phishing through a QR code) between April 2024 and April 2025, with almost £3.5 million lost. It found car parks to be the most common setting, with criminals sticking their own codes on parking machines [1]. The Bureau of Investigative Journalism found that nearly a third of UK councils had car parks targeted; in Sheffield, every one of the council's 370 ticket machines was hit [2].
Closer to home for us in Lancashire, fake codes appeared on pay-and-display machines in Lytham St Annes in 2024. One driver said she lost £1,500 within minutes of paying at St Annes beach car park, and fresh stickers went up after Fylde Council removed the first ones [3]. The RAC's advice is to avoid parking QR codes altogether and pay by cash, card or the operator's own app [4].
Victims describe a consistent pattern: a small charge that looks like the parking fee, followed by larger payments for subscriptions they never signed up to [2]. The National Cyber Security Centre (NCSC) notes that codes in open, unsupervised places such as car parks and stations are easier to tamper with than codes in a pub or restaurant [5].
This matters to a board for two reasons. The phone that scans the code is often the same phone that holds your people's Microsoft 365 sign-in and authenticator app. And the workplace version of the same lure, a code asking a member of staff to re-register their sign-in, leads to a page that looks exactly like Microsoft's.
Where your controls can and cannot see
Most firms we work with assume QR risk is covered because their email filter deals with it. For incoming email, that is now largely true: Exchange Online Protection and Microsoft Defender for Office 365 extract QR codes from messages as they arrive and check where they lead [6]. Everywhere else, the picture is very different.
| Where the QR code is | What can see it | What this means |
|---|---|---|
| In an email to staff | Microsoft 365 email filtering, if licensed and switched on | Check it is on, and test it with a QR phishing simulation |
| On a poster, letter, parcel or parking machine | Nothing, until someone scans it | No corporate control is involved at all |
| Scanned on a personal phone | Nothing | Outside the firm's network, device management and logging |
| Created on a work laptop from client data | Not file-based DLP | No file, email, upload or USB transfer happens, so the usual rules have nothing to inspect |
| Photographed off a screen | Nothing | The data leaves on a camera, not across a network |
Table 1 reflects the controls we usually find in firms of up to 2,000 staff on Microsoft 365.
What we hear, and the answer
- "Our email filter handles that." It handles email. Most quishing now happens in car parks, on posters and on personal phones, and none of those pass through it.
- "Car park scams are a consumer problem." The same people, with the same habit and often the same phone, hold your sign-ins.
- "We can't stop people using their phones." No, and you should not try. You can limit what each person can see, and how much of it they can see at once.
- "We trust our staff." Most of them deserve that trust. The risk sits in the weeks between a resignation and a leaving date, when access is unchanged but loyalties have moved.
Behind every one of these answers is the same gap: in most cases, people simply do not know how much a QR code can hold, or how easy one is to make.
The reverse direction: data leaving as a picture
In data loss reviews we have carried out for legal and financial firms, the scenario boards worried about most was a familiar one: a salesperson leaving for a competitor and taking contracts and the client database with them. The controls in place watched email, uploads to cloud storage and USB sticks. Nobody had considered a phone camera pointed at a screen.
A QR code makes that easier than most boards expect. One code holds up to 7,089 digits, 4,296 letters and numbers, or about 2,950 bytes of any data [7]. That is enough for the key terms of a contract, a pricing schedule or a few dozen client contacts. Microsoft Word can turn typed text into a QR code with a built-in field code [8], and Edge and Chrome will turn any web address into one in two clicks. A larger file can be split into a sequence of codes: a free tool already turns any file into an animated loop of them [9]. Researchers have shown the same idea moving data out of isolated, monitored environments with nothing more than a screen and a camera [10] [11].
When we create a code from a sample of client data in front of a board, then scan it with a phone, the room changes. Almost nobody had realised how much a code can store, or that the tool to make one is already on every desk. That demonstration has done more than any policy paper we have written.
Your DLP was designed for a world where data leaves as a file. A QR code is not a file until someone photographs it.
What actually reduces the risk
- Limit who can see what. A person who can only see their own clients cannot photograph the whole database. Least-privilege access works whatever route the data takes out.
- Watch the leavers. Microsoft Purview Insider Risk Management includes a ready-made policy for data theft by departing users, triggered by a resignation or leaving date [12]. Unusual downloads, printing and access during a notice period are what it is built to spot. Many firms already hold the licence and have never switched it on.
- Change the policy wording. In your data handling policy, treat putting client data into a QR code exactly like emailing it outside the firm.
- Mark the most sensitive documents. Where the data justifies it, use view-only access and visible watermarks, so a photograph can be traced to the person who took it.
Your own QR codes are part of the risk
If your firm prints QR codes on invoices, letters, reception signs or event material, each one is a place a criminal can stick a replacement. Your client will not blame the sticker; they will blame you. For firms that handle client money, the rule is simple: stop printing QR codes on anything that asks for money. Payment details should only ever be confirmed through a channel the client already knows, such as the phone number in their engagement letter.
Keep a list of every QR code the firm puts out: where it appears, where it points and who owns it. If nobody owns a code, take it down.
Another awareness module will not fix this
Training has its place, but knowing a risk and overriding a habit are different things. Training tells people what to look for; it rarely changes what their thumb does in the two seconds after the camera finds a code. The controls above work whether or not anyone remembers the training. You can test that claim on yourself at the end of this page.
Five questions for your next board meeting
- Is QR code checking switched on for our incoming email, and when did we last test it?
- If one of our people photographed client data on a screen tomorrow, which of our controls would notice?
- Who can see our full client list and contract archive, and does every one of them need to?
- What changes, in access and in monitoring, when someone resigns?
- Where do our own QR codes appear, who owns each one, and does any of them ask a client for money?
Conclusion
QR codes are not going away, and they are no more dangerous than a link. What makes them risky is the habit they have built, and controls that were designed before they arrived. Email is covered. The car park, the personal phone and the screen are not. A board that asks where its data could leave as a picture, and who could take it, will find gaps that no dashboard is showing.
Free PDF of this briefing
Scan to download your copy.
Glossary
| Term | Meaning |
|---|---|
| Data loss prevention (DLP) | Tools and rules that watch for sensitive data leaving the firm, usually by inspecting files, emails and uploads. |
| Insider risk | The risk that someone with legitimate access, such as an employee or contractor, misuses it, deliberately or by mistake. |
| Least-privilege access | Giving each person access only to the information they need for their role. |
| Microsoft Defender for Office 365 | Microsoft's email protection service, which checks incoming messages, links and attachments, including QR codes. |
| Microsoft Purview | Microsoft's family of data protection and compliance tools, including DLP and Insider Risk Management. |
| National Cyber Security Centre (NCSC) | The UK government's technical authority for cyber security. |
| QR code | A square barcode (QR stands for Quick Response) that a phone camera reads. It can hold a web address or plain data. |
| Quishing | Phishing through a QR code: a code that leads to a fake site built to steal card details, sign-ins or other information. |
Table 2. Terms used on this page (alphabetical).
Further reading
From CyberCQR
- All green, still exposed: what your board's cyber report is not telling you
- Identity and Access Management: Top 10 Must-Do Actions
External
References
- [1]Parking Review, £3.5m lost last year to fraudulent QR codes, June 2025, reporting Action Fraud's quishing alert.
https://www.transportxtra.com/publications/parking-review/news/79483/-3-5m-lost-last-year-to-fraudulent-qr-codes - [2]The Bureau of Investigative Journalism, 'Quishing': new QR code scam sweeps UK car parks, 27 June 2025.
https://www.thebureauinvestigates.com/stories/2025-06-27/quishing-new-qr-code-scam-sweeps-uk-car-parks - [3]Blackpool Gazette, Scammers hack bank accounts with fake QR codes taped to car park machines in Lytham and St Annes, June 2024.
https://www.blackpoolgazette.co.uk/news/crime/scammers-attach-fake-qr-codes-to-lytham-and-st-annes-car-park-machines-4680334 - [4]RAC, Be 'QRareful': RAC warns drivers to watch out for parking payment scams, 15 August 2024.
https://media.rac.co.uk/pressreleases/be-qrareful-rac-warns-drivers-to-watch-out-for-parking-payment-scams-3337223 - [5]National Cyber Security Centre, QR codes: what's the real risk?, 8 February 2024.
https://www.ncsc.gov.uk/blog-post/qr-codes-whats-real-risk - [6]Microsoft, Protect your organizations against QR code phishing with Defender for Office 365, 12 December 2023.
https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/protect-your-organizations-against-qr-code-phishing-with/ba-p/4007041 - [7]QR Planet, What storage capacity does a QR Code have? (maximum capacities of the largest QR code).
https://qrplanet.com/help/article/what-storage-capacity-does-a-qr-code-have - [8]Microsoft Support, Field codes: DisplayBarcode.
https://support.microsoft.com/en-us/word/field-codes-displaybarcode - [9]Kali Linux Tutorials, QRExfiltrate: tool to convert any binary file into a QR code movie.
https://kalilinuxtutorials.com/qrexfiltrate/amp/ - [10]Li, Lu, Yan and Tan, Exfiltrating data from an air-gapped system through a screen-camera covert channel, Mathematical Biosciences and Engineering 16(6), 2019.
https://aimspress.com/aimspress-data/mbe/2019/6/PDF/mbe-16-06-374.pdf - [11]Weise, A QR-Code optical covert channel in an air-gapped secure data infrastructure, diploma thesis, TU Wien, 2021.
https://doi.org/10.34726/hss.2022.84700 - [12]Microsoft Learn, Insider Risk Management policy templates (Data theft by departing users).
https://learn.microsoft.com/purview/insider-risk-management-policy-templates
Security is the outcome, not a solution.
CyberCQR is a UK cyber security advisory practice. We help boards find where their data can actually leave, and get more from the Microsoft tools they already pay for, without vendor commissions or product resale.