QR Code Security Guide: Avoid Quishing and Stay Safe
By Diljit Ramachandran · LinkedIn · /about
Published · Last updated · 2 min read
Quishing is a form of QR code phishing: an attack that hides a malicious URL in a QR code so the victim lands on a fake login or payment page. The FBI warned in January 2022 that "cybercriminals are tampering with QR codes to redirect victims to malicious sites that steal login and financial information", and the US Federal Trade Commission published its own consumer alert in December 2023.
A link in an email can be checked before you click; a QR code has to be scanned before you see where it leads.
How do QR phishing attacks work?
The victim scans a code that looks legitimate, their phone opens a convincing login or payment page, and the attacker captures what they type. Attackers use three main routes.
| Route | What happens |
|---|---|
| Physical tampering | A fake sticker covers a real code. The FTC alert describes "scammers covering up QR codes on parking meters with a QR code of their own". Tables, bus stops and bulletin boards are exposed too. |
| Email quishing | A code in an email posing as IT, a bank or a courier. The URL sits inside an image, so link-checking filters can miss it. |
| Fake marketing | Flyers, posters or cards with codes leading to phishing sites or fake prize pages, in cafes, conferences and co-working spaces. |
Can a QR code itself contain malware?
No. A QR code is only encoded text, usually a URL. The risk is the destination it opens, or an app it prompts you to install.
How do you check a QR code before scanning?
Look at the code, then read the URL before you open it. Most of these habits come from the FBI and FTC alerts above.
- Check for tampering. A sticker pasted over another code, or one that does not match the surrounding design, is a warning sign.
- Read the preview. The built-in camera on iOS and Android shows the URL before opening it. Look for misspellings such as paypa1.com, odd subdomains and non-HTTPS addresses.
- Use the native camera. The FBI says: "Do not download a QR code scanner app. This increases your risk of downloading malware onto your device."
- Distrust urgency. "Scan now to avoid suspension" is the same tactic as a phishing email.
- Verify the source. For a code in an email from your bank or employer, go to their official site or app instead.
How can businesses make their QR codes trustworthy?
Use codes you can change, brand them, and watch them. A dynamic QR code is a code that points to a short redirect URL you control, so you can change a compromised destination without reprinting. A static code encodes the final URL, so every printed copy must be replaced.
- Add your logo and brand colours. A plain sticker over a branded code looks out of place, though a logo will not stop a determined copy.
- Point every code at an HTTPS destination.
- Print a text hint such as "Scan to visit ourcompany.com/menu" so people can compare it with the preview.
- Watch scan analytics. A sudden drop at a busy placement can mean the code is covered; a spike from an unexpected country can mean it was copied.
- Inspect public placements regularly and use tamper-evident materials.
What if a printed code is compromised?
With a dynamic code you update the destination in your dashboard in seconds, and every printed code follows.
You can also archive a dynamic code if you suspect abuse. An archived code stops redirecting until you unarchive it, the fastest way to take it out of service. Dynamic codes need a trial or paid plan. QRCodeStack redirect URLs use HTTPS, the creation form rejects malformed destinations, and scan analytics show counts, devices and times, with city-level location on the trial and Business plan. Start from the dynamic QR code generator.
Create Secure Dynamic QR Codes
Change or archive a printed code from your dashboard and watch scan analytics. 7-day free trial, no credit card.