Phishing in 2026: QR codes, MFA fatigue and the invoice that changed its bank details.

Cyber · 6 min · written 30 October 2026 · by the IT-360 team · sources at the end

QR codes in emails and PDFs

The email looks like a shared document or a parking fine, with a QR code to scan. The phone camera opens a login page that is a copy of Microsoft's, on a device that is outside the company's web filtering. The habit: never scan a QR code that arrived by email. Open the service from the app or the bookmark instead.

MFA fatigue

An attacker who already has a password triggers sign-in prompts again and again, at night. Eventually the tired owner of the phone presses approve. The habit: never approve a prompt you did not start, and report it. The technical fix is number matching: the app asks you to type the number on the screen. Microsoft now turns it on by default, and we check it is on for every client.

The supplier whose bank details changed

The most expensive one. A supplier's mailbox is compromised; the attacker watches for an invoice conversation and sends a polite note that the bank details have changed. The email is real, from the real address, in the middle of a real thread. The habit: any change of bank details is confirmed by telephone on a number you already have, before a penny moves. Put it in the finance procedure in writing.

Training that works

Quarterly and short, built from the emails your own staff received that month. A simulated phishing test runs between sessions, with no blame for the people who click. The measure that matters is how fast someone reports a suspicious email, not how many click. The Staff Awareness page describes how we run it.

Further reading on Insights: Passkeys and MFA and Cyber Essentials in 2026.

Sources

• NCSC: phishing attacks, defending your organisation.
• Action Fraud: business email compromise and invoice fraud guidance.
• Microsoft: number matching in Microsoft Authenticator.