Imagine you’re packing up at the end of the day when an email from “Facilities” catches your eye.
Subject: Staff parking permits expire Friday “Keeping your space? Scan the QR code below to renew your permit.”
You park there every morning. You’ll need that space on Monday. So you reach for your phone, thinking you can get this done before you leave.
That’s what makes the request convincing. Renewing a permit sounds like something Facilities would handle. But there’s a question the email hasn’t answered: who controls the page where you’re about to sign in?
1. The email gives you a reason to scan
In this example, the sender doesn’t ask for a password. They ask you to keep something you already have. The Friday deadline gives you a reason to do it now, and the QR code makes it look like a quick task.
Before you pick up your phone, ask yourself: Where would I check my permit if this email hadn’t arrived? If the answer is your staff portal, you already have a way to check the request. Open the portal from your usual bookmark and look for the renewal notice there.
2. The QR code takes you from your inbox to a sign-in page
Suppose you do point your camera at the code. Your phone shows a link preview. At this point, you haven’t given anyone your work password. You can dismiss the preview without opening the link.
If you tap it, a page headed “Staff sign-in” might appear. It may have the same colours and logo you see at work. Those details are easy to recognise, but they don’t tell you who runs the site. The US Federal Trade Commission warns that QR codes in unexpected messages can lead to convincing copies of real websites. Consumer Advice
3. The fake page asks for the one thing the email didn’t
Now there are two boxes: Work email and Password. You’re used to filling them in when you sign in at work. The difference this time is how you got there: the sender chose the destination.
If a scammer controls that page, they can capture what you type. Scanning the square alone didn’t give away your password. Entering it on the fake page can. Consumer Advice
How to check whether your permit actually needs renewing
Open your staff portal the way you normally do. If you find a renewal notice there, handle it inside the portal. If you can’t find one, look up Facilities in your staff directory and call the number listed there. A simple question will do: “I received an email saying parking permits expire on Friday. Did your team send it, and where should I renew?”
Use the directory number rather than the one in the email. That gives you an answer from a contact you chose independently. You can also use SO Mail to inspect the link behind a QR code before opening it. Checking the link and confirming the renewal answer two different questions: Where does this code lead? and Did Facilities actually ask me to go there?
Already entered your password?
Contact your IT or security team straight away using your usual help desk. Tell them which account you entered, roughly when it happened and whether you approved a sign-in prompt. Don’t send them your password. Change it through your organisation’s usual account settings. If you used that password on another account, change it there too. Consumer Advice
The next time an email says “scan to renew,” you don’t have to decide whether it’s fake by looking at the square. Start where you would have gone anyway: your staff portal.
SO Mail is available on iOS and Google Play. Visit soemailsecurity.com to learn more.