QR content observations
Decoded QR content can reveal HTTP(S) URL candidates for configured target matching. A QR code can also contain non-URL content.
EMAIL SECURITY · PACKAGE 2
QR code phishing protection
A sign-in link hidden in a QR code can be missed by someone reviewing only the email text. Supported QR decoding and optical character recognition (OCR) make image and PDF observations available to incoming security policy.
An everyday example
A PDF asks the recipient to scan a QR code to renew an account. If the scanner decodes a configured blocked target in a supported candidate, the saved QR/OCR action can quarantine or reject the message before delivery.
Illustrative scenario; this is not a live message or a detection-rate claim.
How it works
- Find supported candidatesThe scanner considers supported image and PDF candidates in eligible protected incoming mail.
- Decode and extractQR decoding extracts supported QR content; OCR extracts supported visible text. PDF inspection covers the first three pages.
- Use explicit target policiesGlobal and domain blocked-target matches use their configured Accept, Quarantine or Reject action. A separate policy handles incomplete inspection.
What your IT team can control
OCR observations
Recognized text adds evidence from supported images and PDF pages. Image quality, layout and processing limits affect what can be extracted.
Separate URL checks
The QR/image scanner does not open extracted URLs or automatically query a reputation feed. Google Web Risk is used by the separately enabled click-time link protection path.
Coverage and responsibilities
- Remaining PDF pages, unsupported formats and processing limits leave partial coverage. A completed observation is not a clean-mail verdict.
- Configured blocked-target matching is not a guarantee that every phishing destination will be recognized.
- A QR link opened directly on a separate device does not automatically pass through the email click-time check screen.
Choose the incoming security gateway
Email Security requires SecuraWall as the only published MX and a separate real receiving destination. Your mailboxes remain with your provider. Backup MX does not include these inspection or personal quarantine controls; the SMTP Relay add-on does not enable incoming protection.
Explore Email Security Compare pricing