QR codes are convenient but introduce security risks. Users cannot see the destination before scanning, making them vectors for phishing and malware. Understanding these risks helps you use QR codes responsibly.
QR Code Phishing (Quishing)
Attackers place malicious QR codes over legitimate ones or distribute them in phishing campaigns. Since users can't preview the URL, they may scan codes leading to credential-harvesting sites. This is increasingly common in parking meters, restaurant menus, and payment systems.
Verification Best Practices
When decoding QR codes programmatically, validate the content before acting on it. Check URLs against blocklists. Display the decoded content and ask for user confirmation before opening links. Never auto-execute code or commands from QR codes.
Secure QR Code Generation
When generating QR codes, use HTTPS URLs exclusively. Consider signed URLs that can be verified. Include domain branding so users recognize legitimate codes. Track scans to detect if codes are being copied or replaced.
Physical Security
QR codes in physical locations can be replaced by stickers. Inspect codes before scanning—look for overlays or tampering. Businesses should regularly verify their posted codes still point to correct destinations. Consider tamper-evident printing.