Microsoft Teams rolls out QR code shielding and caller brand-impersonation warnings

Microsoft is adding two anti-phishing defenses to Teams: external senders' QR codes will be hidden by default starting October 2026 (Roadmap entry 570439), and Teams Calling will warn users about brand-impersonating VoIP calls in a mid-to-late May 2026…

Two Microsoft Teams security features target common social-engineering vectors. First, per Microsoft 365 Roadmap entry 570439, Teams will obscure images containing QR codes sent by external users, requiring users to reveal them before viewing or scanning; rollout is expected to begin in October 2026 for Android, desktop, iOS, and Mac. The feature aims to curb QR code phishing, which NordVPN says has redirected more than 26 million users to malicious websites, with 73% of Americans scanning codes without verifying destinations. Second, Teams Calling is gaining Brand Impersonation Protection, which evaluates inbound VoIP calls from first-time external callers for signs of brand impersonation and displays warnings before users answer high-risk calls. That feature rolls out from mid-May 2026 with completion expected by late May 2026, is enabled by default, and requires no administrative action; users can accept, block, or end flagged calls, and alerts may continue throughout a call if suspicious activity persists. Microsoft recommends preparing helpdesk teams and updating security awareness materials ahead of deployment.

• Microsoft 365 Roadmap entry 570439: QR codes from external senders will be hidden by default in Teams and must be revealed before viewing or scanning.
• QR code obscuring rollout is expected to begin in October 2026 for Android, desktop, iOS, and Mac clients.
• NordVPN: QR code phishing has redirected more than 26 million users to malicious websites; 73% of Americans scan QR codes without verifying destinations.
• Brand Impersonation Protection in Teams Calling evaluates inbound VoIP calls from first-time external callers for signs of brand impersonation and warns users before they answer high-risk calls.
• Calling feature rollout: begins mid-May 2026, completion expected by late May 2026; enabled by default and requires no administrative action.
• Users can accept, block, or end flagged calls; alerts may continue throughout a call if suspicious activity persists.
• Microsoft recommends preparing helpdesk teams and updating security awareness materials ahead of the calling feature's deployment.