In some cases, suspicious emails might contain QR codes to take you to a web site for further action :-
For example :-
From: UoP Helpdesk <helpdesk.port.ac.uk@gmail.com>
Subject: Mail Quota
Dear User,
Your email quota is close to being used up. To enable additional quote, please fill out the form found on the link below :-
In general, QR codes can contain web site addresses, but because they are encoded, it makes it harder for you to read them (so you can’t think “Hey! That looks odd”) and harder for security software to process them.
Anywhere where they appear where an ordinary link would serve just as useful service, should add some suspicion. Painted on the side of the building is another matter.
For example, in the email above :-
- There is no “To” and your address doesn’t appear in it.
- The “From” address is wrong both in terms of the “name” (we don’t have a “Helpdesk”, we have a “Servicedesk”) and in the form of the address (helpdesk.port.ac.uk@gmail.com – look where the “@” is, and the presence of “port.ac.uk” as part of the bit before the “@”).
- The salutation (“Dear User,”) is generic and not specific. Legitimate emails can be generic but it’s still a suspicion point to add to the overall score.
- The “Your email quota is close to being used up” adds a sense of urgency to take the action before bad consequences.
- And lastly using a QR code instead of a web site address so you can’t inspect the address adds more suspicion.