The scam that skips your spam filter and lands in your hand: the QR code.Microsoft says QR-code phishing — "quishing" — jumped 146% recently, drawn from its analysis of more than 8.3 billion email phishing threats in a single quarter [TechRadar / Microsoft, Q1 2026]. The reason attackers love it is simple: a QR code is just a picture to your email security, so it sails through filters that would block a bad link. Then you scan it with your phone — a device with far less protection than your work computer — and you're on the attacker's page before you've thought twice.It works because of how we behave: 73% of people scan a QR code without checking where it actually goes [Keepnet Labs, 2026].Where they show up: a fake "your mailbox is full, scan to verify" email, a "review your invoice" PDF, a sticker slapped over the real QR code on a parking meter or a restaurant table, a "set up your MFA" message that looks like it's from IT.Three habits worth sharing with the whole office:1. Treat a QR code in an email like a link from a stranger. If you wouldn't click a surprise link, don't scan a surprise square. Legitimate companies rarely need you to scan a code from inside an email.2. Look before you load. Most phone cameras preview the web address before opening it. Read it. If it's a jumble of characters, a shortened link, or not the company you expected — stop.3. Go direct instead. Need to check your mailbox, an invoice, or your account? Open the app or type the company's website yourself. Never let the code be your only way in.If your office uses QR codes on printed materials, check periodically that nobody has stuck a fake one over yours — it happens in parking lots and lobbies more than you'd think.(970) 372-4940-techframework.comBe honest — when a QR code lands in front of you, do you check the address first, or just scan and go? ... See MoreSee Less

Mid-June check-in from the Technical Framework team, for offices across Fort Collins, Loveland, Greeley, Windsor, Wellington, and the rest of Northern Colorado.A pattern from this week's tech news worth passing along: the incidents making headlines aren't exotic. A breach exposing dental insurance records. A phone flaw being exploited before most people installed the update. Business websites taken over because a plugin update from March never got applied.The common thread is ownership. Not effort, not budget — ownership. The website "the old agency" built. The phones everyone uses for work email but nobody manages. The service account a vendor set up in 2021. Every office has these unowned corners, and they're exactly where problems start — because the things someone clearly owns (the server, the laptops, the email) tend to get taken care of.Three ownership questions worth asking around the office this month:→ Who owns our website updates — by name? If the answer is a shrug, that's the to-do.→ Who makes sure phones with work email on them get their security updates?→ If something alarming happened on our network on a Saturday night, who would actually see it — and what are they allowed to do about it?None of these need a big project. They need a name next to a responsibility — and sometimes a partner who makes the whole list someone's actual job.That's a lot of what we do for offices in the 10-to-100 person range across Northern Colorado: we come to you, we put names (ours) next to the unowned corners, and the list stops growing in the dark.(970) 372-4940-techframework.comWhat's the one piece of technology in your office that, honestly, nobody owns? ... See MoreSee Less

Blog Archives

SOC 2 Readiness Support for SaaS & Service Providers

PCI DSS Compliance Support for Merchants & Service Providers

HIPAA Compliance Support for Healthcare Practices in Northern Colorado

CMMC, ITAR & NIST 800-171 Support for Defense-Industry Suppliers

Law Firm IT Support

Servers

Microsoft Azure

SharePoint Online

Microsoft 365

Network Firewalls

FACEBOOK