# QR codes in security awareness training

> Simulated QR phishing works like simulated email phishing, place codes on posters, mail inserts or fake notices, measure who scans, and land everyone on a short, blame-free teaching page. Never harvest real credentials. Static codes with UTM parameters and one code per placement give you full measurement with free tooling.

Source: https://useqr.app/docs/security/qr-codes-in-security-awareness-training · Last reviewed 2026-08-21 · UseQR is free forever, no signup.

---

## Why QR belongs in the programme

Most awareness programmes still train two reflexes (hover over links, distrust
attachments), and neither transfers to a poster in the lift. QR phishing exploits a
channel with no hover state and no filter:
[quishing](/docs/security/quishing-explained) moves the victim to a personal phone outside
corporate protection, and
[codes in images sail past email filters](/docs/security/why-qr-phishing-bypasses-email-filters)
that would catch the same URL as text. If your last simulation was email-only, your
measured resilience has a blind spot exactly where attackers are aiming.

## Designing a simulated QR campaign

Simulate the placements real attackers use:

| Vector | Simulates |
|---|---|
| Poster drop in kitchens, lifts, lobbies | Malicious flyer on the premises |
| Mail insert or desk drop | [Codes arriving by post](/docs/security/qr-code-scams-on-packages-and-mail) |
| Email with a code in an attached PDF | The classic [quishing email](/docs/security/qr-codes-in-phishing-emails) |
| Fake notice on the car park (own premises only) | Parking-scam stickers |

Generate **one code per placement** with the [bulk generator](/bulk), when the "free
coffee" poster in the lift outperforms the mail insert three to one, you have learned
where your people are least suspicious, which is the entire point of the exercise.

## Measurement without harvesting

Static codes plus URL parameters give complete measurement with no phishing platform:

```
https://training.example.com/lp?utm_source=qr&utm_campaign=sim-q3&utm_content=lift-poster
```

Tag each code with a [UTM parameter](/glossary/utm-parameter) per placement: the
technique is the ordinary one from
[adding UTM parameters to a QR code](/docs/how-to/how-to-add-utm-parameters-to-a-qr-code),
and your existing analytics shows the funnel: scans, then click-throughs on the landing
page, then attempted form submissions.

The ethical line sits at that last step, and it is bright: **a simulation never collects
real credentials**. If the page includes a login form for realism, it must accept any
input, transmit and store nothing, and flip to the reveal on submission. You are
measuring the decision to type, not the password. Punishing individuals is equally out:
publish aggregate results, coach privately.

## The teachable-moment page

The reveal page is the highest-value screen in the programme: the lesson arrives five
seconds after the mistake, on the device where it happened. Keep it short, blame-free and
concrete, congratulate the curiosity, name the exercise, then teach the three checks
from [how to check a code before opening](/docs/security/how-to-check-a-qr-code-before-opening):
read the domain on the preview banner, distrust shorteners, never enter credentials on a
page you reached by scanning. One screen, no video, no quiz gate.

## Ground rules

- **Sign-off first.** Leadership, HR and works-council approval where applicable; staff
  informed in general terms that simulations happen.
- **Contain the blast radius.** Physical drops stay on your own premises so visitors and
  passers-by are not phished by proxy: a fake parking notice on a public street is an
  incident, not a simulation.
- **Verify before deploying.** A simulation code that fails to scan measures nothing;
  run each one through a [decode check](/validate) first.
- **Close the loop.** Debrief openly with aggregate numbers, repeat quarterly, and fold
  findings into the [enterprise QR policy](/docs/security/enterprise-qr-code-policy).

## FAQ

### How do you run a QR phishing simulation?

Place uniquely tagged codes where attackers would (posters, mail inserts, email PDFs)
route every scan to a blame-free teaching page, and measure scans and click-throughs per
placement through ordinary analytics. Never collect real credentials at any step.

### What should a QR phishing landing page say?

That this was a training exercise, without blame, followed by the three habits that would
have caught it: read the domain on the scanner's preview banner, distrust shortened
links, and never enter credentials on a page reached by scanning.

### Is it ethical to test employees with fake QR codes?

Yes, with the same guardrails as email simulations: leadership and HR sign-off, staff
aware that simulations occur, no real credential collection, no individual punishment,
and placements confined to your own premises.

### Do simulated phishing tests collect passwords?

They must not. A realistic form may be shown, but it should accept anything, store
nothing and immediately reveal the exercise. The metric is the attempt to submit, never
the submitted value.

## Try it

- https://useqr.app/url
- https://useqr.app/bulk
- https://useqr.app/validate