Stolen login
A pixel-perfect fake Microsoft 365 sign-in page captures your password and your MFA code in real time.
Incident detected
You just scanned a random QR code.
…and it could’ve gone anywhere.
Status: harmless (this time)
Relax. This one is a BCIT Information Security awareness exercise. This page has no scripts, no cookies, no trackers, and no forms. It just wanted to make a point.
What a bad code could have done
It’s called quishing: phishing with a QR code. It works because you can’t read a QR code with your eyes, and most email filters can’t read a picture.
Drained card
A “pay for parking here” sticker sends your card number straight to a criminal.
Compromised phone
A “required” app or configuration profile gives an attacker a foothold on your device.
Hijacked mailbox
One tap on “Allow” at a fake app consent screen hands over your email. No password needed.
Next time, do this
- Read before you tap. Your camera shows the link first. Weird domain, typos, or a link shortener? Stop.
- Check for stickers. Attackers slap their own codes over real ones on signs, parking meters, and posters.
- Never log in or pay from a scanned link. Open the official app or type the address yourself.
- Don’t install anything. If a code wants you to download an app or profile, walk away.
- Report it. Spotted a sketchy code? Tell infosec@baltimorecity.gov. You’ll protect the next person.
