2026-04-05·9 min read

QR Code Security: How to Stay Safe from QR Phishing and Scams

securityQR codesphishingquishing

The Rise of QR Code Scams

As QR code usage has exploded, so have QR-based attacks. The FBI, FTC, and cybersecurity agencies worldwide have issued warnings about "quishing" — QR code phishing attacks where criminals use fraudulent QR codes to redirect victims to malicious websites, steal credentials, or install malware.

The fundamental vulnerability is simple: humans cannot read QR codes with their eyes. When you scan a QR code, you trust that it leads where it claims to lead. Attackers exploit this trust by placing malicious QR codes over legitimate ones, distributing them via email, or posting them in public spaces.

Common QR Code Attack Vectors

Physical Overlay Attacks

The most common attack in public spaces. A criminal prints a malicious QR code on a sticker and places it over a legitimate one. Common targets include:

Parking meters: Fake QR codes redirect to phishing payment pages that steal credit card information
Restaurant menus: Overlay codes lead to fake ordering pages that capture payment details
Public transit: Fraudulent codes replace legitimate ticket purchase links
Trailheads and tourist sites: Fake informational codes lead to malware downloads

Email Quishing

Attackers embed QR codes in phishing emails. Since QR codes are images, they bypass many email security filters that scan text and URLs. The email typically urges the recipient to scan the code to "verify their account", "view an invoice", or "update payment information".

Malicious Flyers and Mailers

Criminals post flyers with QR codes in public spaces or mail them to homes. These often promise free products, discounts, or prizes. The QR code leads to a credential harvesting page or triggers a malware download.

Social Engineering

Attackers place QR codes in contexts where people expect to scan — conference booths, co-working spaces, or community bulletin boards. The social context makes people less suspicious.

How to Protect Yourself as a Scanner

Before Scanning

1. Inspect the QR code physically: Look for stickers placed over other codes. If the code appears to be a sticker overlaid on a sign, poster, or payment terminal, do not scan it

2. Consider the context: Is this QR code in a place where you would expect one? A QR code taped to a random lamppost is suspicious. One on a branded restaurant table tent is more trustworthy

3. Check for tampering: If a printed QR code looks different from others nearby (different size, quality, or alignment), it may have been replaced

After Scanning

4. Preview the URL before opening: Most smartphone cameras show the URL before navigating. Read it carefully. Look for misspellings (paypa1.com instead of paypal.com), suspicious domains, or unexpected redirects

5. Verify HTTPS: The destination should use HTTPS (padlock icon). While HTTPS alone does not guarantee safety, HTTP is a red flag for any site requesting personal information

6. Do not enter credentials immediately: If a QR code leads to a login page, navigate to the service directly through your browser instead of entering credentials on the QR-linked page

7. Be cautious with downloads: Never install apps or download files from QR code destinations unless you are certain of the source

General Habits

8. Keep your phone updated: Operating system updates include security patches that protect against QR-based exploits

9. Use a QR scanner with URL preview: The built-in camera app on iOS and Android shows URL previews. Avoid third-party QR apps that auto-navigate without preview

10. Trust your instincts: If something feels off about a QR code situation, skip the scan and type the URL manually

How to Protect Your Business

Securing Your QR Codes

If your business uses QR codes for payments, menus, or customer interactions:

Monitor your codes regularly: Check physical QR codes for sticker overlays during daily opening procedures
Use tamper-evident materials: Print QR codes on materials that show visible damage when stickers are applied over them
Register your domains: If your QR code points to yourbusiness.com, also register common typos and variations to prevent typosquatting
Educate staff: Train employees to recognize and report suspicious QR codes in your business area

Securing Your Digital QR Codes

Use your own domain: Always link to URLs on your own domain, not through third-party URL shorteners that could be compromised
HTTPS only: Ensure all QR code destinations use HTTPS with valid certificates
Regular link audits: Periodically scan your own QR codes to verify they still point to the correct destination
Short, recognizable URLs: Use clean, branded URLs that are easy for users to verify at a glance

Customer Communication

Tell customers what to expect: "Scan this code to view our menu at restaurantname.com" helps customers verify they are on the right site
Provide alternatives: Always offer a typed URL or NFC option alongside QR codes. This helps customers who are wary of scanning and improves accessibility
Respond to reports: If a customer reports a suspicious QR code, investigate immediately and replace if necessary

QRForge Security Features

QRForge is designed with security in mind:

No tracking or analytics: Your QR codes do not route through any proxy server. The destination URL is encoded directly in the QR code
Client-side generation: QR codes are generated entirely in your browser. No data is sent to any server
No URL shortening: The full URL is encoded, so scanners see the actual destination, not a redirect
No account required: You do not need to create an account or share any personal information to generate QR codes

Recognizing Quishing Emails

QR code phishing emails share common characteristics:

Urgency: "Your account will be locked in 24 hours — scan to verify"
Vague sender: Generic sender names like "IT Security" or "Account Services"
No text URL: The email contains only a QR code with no clickable link (because a clickable link would be caught by email filters)
Professional appearance: These emails often use stolen branding and look legitimate
Unusual request: Asking you to "scan with your phone" from a desktop email is unusual for legitimate services

If you receive such an email, do not scan the QR code. Contact the supposed sender through their official website or phone number to verify.

The Future of QR Code Security

The security community is developing several approaches to make QR codes safer:

Signed QR codes: Cryptographic signatures that let scanners verify the code was created by a trusted source
Blockchain verification: Decentralized registries of legitimate QR codes
AI-powered detection: Smartphone OS-level scanning that warns about known malicious destinations
Visual authentication: Branded QR code designs that are harder to forge

Until these technologies mature, vigilance remains the best defense.

Frequently Asked Questions

Can scanning a QR code install malware on my phone?

Simply scanning and previewing a QR code is safe on modern phones. The risk comes from visiting the linked website and downloading files or entering credentials. Keep your phone updated and never install apps from QR code links.

Are QR code payments safe?

QR code payments through established systems (Apple Pay, Google Pay, Venmo, PayPal) are safe when you verify you are on the correct platform. Be suspicious of QR codes that lead to unfamiliar payment pages.

Should I avoid QR codes entirely?

No. QR codes are a useful technology when used responsibly. Just apply the same caution you would with email links: verify before you click (or in this case, verify before you open the URL after scanning).

How can I report a malicious QR code?

If you find a suspicious QR code in a public place, report it to the business that operates the space. For quishing emails, report them to your IT department and forward to your email provider's abuse team. You can also report to the FTC (reportfraud.ftc.gov) or your local cybersecurity authority.

Conclusion

QR codes are here to stay, and so are the security risks that come with them. The good news is that protecting yourself is straightforward: inspect before scanning, preview URLs before navigating, never enter credentials on QR-linked pages, and keep your devices updated. For businesses, regularly monitor physical QR codes and educate customers about what to expect. Use trustworthy tools like QRForge that generate clean, direct QR codes without proxies, tracking, or server-side processing.