QR Code Scams in Teams: What Changes and How to Prepare

An external contact sends a message in Teams: "Here is the QR code to confirm your access." The phone is already in hand, the camera opens in a second and, by the time the person notices, they have typed their corporate password into a fake page. The QR code scam, already common by email, has reached workplace tools. And Microsoft Teams has started to respond.

What changes in Teams

QR codes from external contacts arrive hidden. Images containing QR codes sent by users outside your organization are now obscured by default in chats. To view or scan them, the user has to reveal the image deliberately. According to Microsoft, the feature has been rolling out since October 2026 in Teams for desktop, web, Mac, Android and iOS.

Detection of malicious QR codes (expected in November 2026). Teams will analyze where a QR code leads and apply protection when the destination is malicious, extending to QR codes the protection that already exists for links.

AI-powered phishing detection in first external chats (expected in November 2026). Microsoft also announced phishing detection that uses conversation context to identify scams and social engineering, mainly when an external contact starts the first chat. When something looks suspicious, users may see a warning.

Why QR codes became a scam tool

A QR code hides its destination: nobody can tell where it leads just by looking at it. It is also usually scanned on a personal phone, which is often outside the company's protections. It is the perfect combination to lead someone to a fake login page.

The extra step of "revealing" the image seems small, but it breaks exactly the impulse scammers rely on: acting fast, without thinking.

What your company can do right now

• Train your team: a QR code from outside deserves attention, even inside Teams. When in doubt, confirm with the sender through another channel.

• Treat a QR code like a link: if the page asks for a password, verification code or payment, be suspicious.

• Review Teams external access: define which domains and organizations can chat with your company and with which permissions.

• Turn on multifactor authentication for everyone: if a password leaks in a scam, the second factor greatly reduces the risk of account takeover.

• Protect the phones that access company data: managed devices apply security policies on the phone too, where QR codes are scanned.

Sources

The information in this article comes from the Microsoft 365 Roadmap, items 570439 (QR code protection in messages), 576198 (detection of malicious QR codes) and 575288 (phishing detection in Teams), checked on October 21, 2026. Roadmap dates are estimates and may change.

Need help?

WRA IT helps companies set up Microsoft 365 securely: Teams external access, multifactor authentication, device management and training teams against scams. Talk to WRA IT.