QR Codes and Security

How QR code scams typically work

Most malicious QR code activity falls into a few patterns:

• Sticker overlays on legitimate codes. A malicious code is physically printed on a sticker and placed directly over a legitimate one — a parking meter, a restaurant table tent, a public poster. The victim scans what looks like the expected code and lands on a fraudulent payment page or malware download instead.
• Phishing pages disguised as familiar services. A scanned code leads to a page designed to look like a bank login, a package delivery notification, or a payment portal, aiming to harvest credentials or payment information directly.
• Codes distributed via email or physical mail. Increasingly used as a phishing tactic specifically because email security scanners are generally better at flagging malicious text links than at parsing what's encoded in an embedded image of a QR code — the code itself slips past filters that would catch the equivalent plain-text URL.
• Malicious app or profile installation. Some codes attempt to trigger the installation of a malicious app or a device configuration profile rather than just opening a webpage — this is more device-and-OS-dependent but is a real risk category, particularly on Android where sideloading is more permissive.

How to verify a code before trusting it

• Check for a preview before it opens automatically. Most modern phone camera apps show the destination URL as a preview before actually navigating there — read it before tapping through. If the URL looks unfamiliar, misspelled, or unrelated to the context (a QR code on a parking sign leading to an unrelated domain), don't proceed.
• Look for physical tampering. A sticker slightly misaligned or layered on top of a sign, especially in public high-traffic locations like parking meters or transit stops, is a specific red flag worth a second look before scanning.
• Be more cautious with codes from unsolicited sources. A QR code in an unexpected email, text message, or physical mail piece — especially one urging urgency ("verify your account now," "unpaid toll") — deserves the same skepticism as an unexpected link, because functionally it is one.
• Never enter payment or login credentials on a page reached via QR code unless you're confident of both the source of the code and the legitimacy of the destination page itself — matching branding isn't sufficient confirmation on its own, since phishing pages are often built to visually mimic the real thing.

If you're publishing codes yourself

The responsibility runs both ways — if you're the one putting codes into the world, a few practices reduce the odds of your own materials being spoofed or misused:

• Use tamper-evident placement where possible for anything in a public, unsupervised location — printed directly onto the material rather than as a separate sticker that could be overlaid by someone else's sticker.
• Periodically check your own public-facing codes in the field, particularly in high-traffic public locations, to confirm nothing has been physically altered or covered.
• If using a dynamic QR code, secure the account that controls the redirect destination with a strong, unique password and multi-factor authentication where available — since anyone who compromises that account could redirect every already-printed code to a destination of their choosing.