Your Buyer Was Trained Not to Scan You

You get to the end of the meeting, open your phone, and hold up a QR code. The buyer looks at it. Then there is a pause, maybe a second long, before they reach for their own phone. Sometimes they never reach at all. They say they will find you on LinkedIn.

That pause is fairly new, and it is not about you. It is the sound of somebody’s security training working exactly as designed.

Scanning a stranger’s code became a security decision

Cisco Talos, in its incident response trends for the second quarter of 2026, found that phishing was the initial access vector in more than half of the engagements where entry could be determined, up from roughly 35% the quarter before. Sitting inside that trend is a technique the report names directly: attacker generated PDF documents carrying QR codes that lead to credential harvesting pages.

The advice Talos gives defenders is the part that should interest you, because it is not written for you. They recommend that network defenders block or flag emails containing QR codes inside PDF attachments. Read that as a seller rather than as an engineer. Inside the companies you sell to, the QR code is quietly being reclassified from a convenience into an indicator.

The people you most want to reach were warned first

Abnormal Security’s research put the C-suite at 42 times more QR code attacks than the average employee, with senior vice presidents and department heads at five times the average. That figure comes from their H1 2024 email threat report, so treat the exact multiple as dated. The shape of it has not changed: attackers point QR codes at senior people, so senior people receive the most pointed training about them.

Which is the seat you are pitching to. The more senior the person across the table, the more likely their year included a simulated phishing exercise built around a code that looked exactly like the one you are holding up.

A code cannot be checked before it is taken

Every other link a person receives can be inspected first. You can hover a hyperlink and read the domain in the corner of the screen. A QR code is a picture of a destination, unreadable until the camera has already resolved it, and it is almost always opened on a personal phone rather than a managed laptop. Barracuda documented attackers pushing that further in August 2025, splitting a code across two harmless looking images that only combine into a working one inside the mail client. Filters are losing the ability to pre-check these at all, which is exactly why policy drifts toward blocking them outright.

What this changes in the last minute of a meeting

Nothing about the above says stop using QR codes. It says stop treating a scan as the whole plan.

A refused scan does not announce itself as policy

Nobody says out loud that their company told them not to scan things. They say the lighting is bad, or their camera is being slow, or that they will look you up later. You record the meeting as warm and move on. The contact record never appears, and six weeks later you cannot reconstruct why.

One handoff path is a single point of failure

If the scan is the only way you know how to give somebody your details, then one cautious buyer, one locked down phone, one camera that will not focus in a dim hotel bar, and the exchange is over. You are back to spelling your surname while they type it into a notes app, which is where contact details go to die.

The destination matters more than the delivery

When somebody does scan, the next thing they see decides whether the pause was worth it. A shortened link with a random string on a domain they have never heard of confirms every instinct their training installed. A page that loads instantly with your name, your company and your photo does the opposite, and it does it in under a second.

Give people more than one way to take your details

The practical fix is unglamorous: carry several handoff paths and use whichever one the moment allows. A digital card should be able to move by QR, by NFC tap, by AirDrop, or as a plain link you can drop into a message thread that is already open, and the person receiving it should not have to install anything to keep what you sent. Apple Wallet and Google Wallet matter here for a reason people underrate, which is that a wallet pass is not a scan at all. It is an object the buyer already trusts, sitting next to their boarding passes, still there in four months when the project finally gets budget. If you are the one holding up the phone in these rooms, get the HeyDrop app and stop depending on a single gesture working.

Now the honest limit, because this is where the category usually oversells. None of this makes a stranger trust you. A buyer who has decided not to take your details will not take them, and no amount of tapping changes that. What multiple paths remove is the failure mode where somebody was perfectly willing and the mechanism simply did not work.

Whatever comes back at you is still paper

The exchange is not symmetrical. You can modernize your own side completely and still walk out of an event holding a stack of printed cards and a conference badge somebody handed you across a table. That is the format the other direction still arrives in, and it is the direction that actually feeds your pipeline. An AI contact scanner reads printed cards and badges into structured contacts, and those contacts export to CSV and Excel, which is where your CRM picks the work up. The export being the end of the line is deliberate. No invisible sync, no field mapping chosen by somebody else, just a file you can open and check before it touches your pipeline.

When several people carry your company’s name

All of this gets worse across a team, because inconsistency is itself a trust signal. Four people work a stand, and four slightly different cards go out, on four different link formats, two of them created last night on a free tool nobody approved. A buyer who has been trained to look at where things point now has four things to be uncertain about instead of one. Central creation fixes the boring half of this: one consistent destination, titles that match the org chart, a new starter contactable on their first morning and switched off on their last. If you run a sales team or staff events with several people at once, set your team up on HeyDrop rather than leaving everyone to improvise their own version.

Three things to change this week

• Watch for the pause. Next time somebody hesitates at a scan, do not push the phone closer. Say you will send it as a link instead and ask for the best number or address to send it to. You are trading one channel for a better one.
• Look at what your own code opens. Scan it yourself from a phone that is not logged into anything. If what loads looks like something you would warn a colleague about, fix that before you fix anything else.
• Stop leaving the exchange to the last thirty seconds. The handoff currently happens when everyone is standing up and reaching for bags, which is the worst possible moment to ask somebody to take a small security risk with a stranger.

The uncomfortable part is that this problem was not created by your buyers and cannot be solved by being more persuasive. Somebody sent a lot of malicious QR codes at a lot of executives, and the entire category of handing over your details in person got a little bit harder for everybody who was never doing anything wrong.

This article and its accompanying image were generated with the assistance of AI.