QR Code Security and Safety

The Core Risk

QR codes are inherently opaque. Unlike a printed URL that a human can read and evaluate, a QR code is a machine-readable pattern that reveals its contents only after scanning.

This opacity is what makes QR codes convenient — and potentially dangerous. A malicious QR code looks identical to a legitimate one.

Threat Types

QRishing (QR Phishing)

QRishing is the QR equivalent of email phishing. Attackers place fake QR codes in public spaces — over parking meters, on restaurant tables, or on fake government notices. When scanned, the code redirects to a phishing site.

Malicious Redirects

A QR code can redirect through multiple URLs before reaching the final destination, making it harder to detect malicious intent. The initial URL might pass basic safety checks while the final destination hosts malware.

Sticker Attacks

The simplest attack: placing a sticker with a malicious QR code over a legitimate one. Especially effective in public spaces where QR codes are trusted (parking, transit, government buildings).

WiFi Credential Theft

Malicious WiFi QR codes can connect the user to a rogue access point controlled by the attacker. Once connected, all unencrypted traffic can be intercepted (man-in-the-middle attack).

Safe Scanning Practices

For anyone scanning QR codes in the wild, follow these rules:

For QR Code Creators: Security Checklist

If you create QR codes for your business, protect your users:

• Use HTTPS — Always link to HTTPS URLs. HTTP links expose users to interception.
• Use your own domain — Branded URLs (yourbrand.com/menu) build trust. Avoid generic URL shorteners.
• Tamper-proof placement — Use engraved, printed-under-glass, or sealed QR codes to prevent sticker attacks.
• Monitor your URLs — Regularly check that destinations are still correct and haven't been compromised.
• Include context — Add text explaining where the code leads: "Scan to view our menu at restaurantname.com."
• Report abuse — If you find tampered QR codes, report them to the venue and local authorities.

URL Preview: Your First Line of Defense

Modern smartphone cameras (iOS 11+ and Android 8+) show a URL preview banner before opening any QR-scanned link. This is the single most important security feature.

1. Read the preview URL carefully before tapping
2. Check the domain name (not just the page path)
3. Look for suspicious character substitutions (e.g., g00gle.com instead of google.com)
4. Cancel if the domain is unfamiliar or suspicious

Enterprise Security Considerations

For organizations deploying QR codes at scale:

• Centralized QR management — Track all QR codes created. Know what each code links to.
• Regular auditing — Periodically scan your deployed QR codes to verify destinations.
• Employee training — Educate staff about QRishing risks, especially finance and customer-facing roles.
• Incident response — Have a plan for compromised codes (remove, notify users, redirect).