When a QR code appears on a sign, in an email, or in a Teams message, it is just the same as a link and there’s no easy way to tell where it really leads until you scan it.
A malicious QR code could send you to a fake login page to steal your login credentials, install harmful software, or trick you into giving away personal or financial information.
Treat QR codes the same way you would treat links from unknown sources: only scan them if you trust who sent or displayed them and be cautious if anything looks out of place.