Microsoft Teams to Obscure External QR Codes Against Phishing
Microsoft Teams will automatically hide QR codes shared by external users, requiring a manual reveal to combat phishing and fraud.
Microsoft is implementing a new security measure within Microsoft Teams designed to thwart QR code-based phishing attacks. The upcoming feature will automatically obscure QR codes embedded in messages sent by external users, adding a crucial layer of friction that aims to make malicious scans more difficult.
Users will no longer see external QR codes directly. Instead, they will be presented with a prompt to manually reveal the image before they can view or scan it. This change, detailed in a Microsoft 365 Roadmap entry, is intended to encourage more deliberate user interaction with potentially untrusted QR code content, thereby reducing the risk of accidental redirection to malicious websites or fraudulent applications.
The rollout of this new protection is slated to begin in October 2026, with availability expected across Android, desktop, iOS, and Mac platforms. This proactive step by Microsoft addresses the growing prevalence of QR code exploitation, a tactic that has seen a significant surge in popularity.
QR codes, once a niche technology, have become ubiquitous in daily life, especially since the COVID-19 pandemic, facilitating contactless interactions for everything from menus to payments. Their ease of use, however, is also their Achilles' heel. Users often scan codes without knowing their ultimate destination, a blind spot that threat actors readily exploit.
Research indicates a significant portion of the public scans QR codes without verifying their destination, leading to millions of users being redirected to malicious sites. The U.S. Federal Trade Commission has previously warned consumers to treat QR codes found on unexpected packages with suspicion, highlighting the widespread nature of these scams.
By introducing the manual reveal step for external QR codes, Microsoft aims to mitigate this risk within its Teams platform. While not a complete solution to QR code phishing, this feature is expected to serve as a valuable deterrent, prompting users to exercise greater caution when encountering codes from unknown or external sources.
This enhancement to Teams security reflects a broader industry trend of adapting communication and collaboration tools to counter evolving phishing techniques. As attackers become more sophisticated, platforms are increasingly incorporating built-in safeguards to protect their user bases from common social engineering tactics.
The upcoming Microsoft Teams QR code protection feature is scheduled to begin rolling out in October 2026 and will be available across Teams desktop, Mac, Android, and iOS clients. Microsoft has classified the update for both Targeted Release and General Availability phases under Roadmap ID 570439, indicating a broad deployment strategy. This feature aims to mitigate phishing and fraud risks by obscuring QR codes within images sent by external users by default, requiring recipients to actively reveal them before scanning.