QR Code Safety Guide
QR codes hide their destination by design. Here is how that gets abused, and the habits that make it a non-issue.
On this page
The core problem in one sentence
A QR code is unreadable to humans, so you cannot tell a legitimate one from a malicious one by looking — which is precisely what makes swapping one for another such a cheap attack.
How the scams actually work
Sticker-over-sticker
A printed code on a parking meter, a restaurant table or a charging point is covered with a sticker carrying a different code. The replacement leads to a convincing payment page. This is the most common variant because it requires nothing but a printer.
Phishing by post and email
A letter or email carries a code instead of a link, because a code slips past link scanners and hides the domain. The landing page asks for credentials.
Payment redirection
A crypto or bank-transfer payment code is replaced with the attacker's. Because these payments are irreversible, the money is gone before anyone notices.
Wi-Fi codes
A "free Wi-Fi" code joins a network the attacker runs. Encryption on individual sites limits the damage, but it is still a network you did not choose.
Habits that defeat all of the above
- Read the URL before opening it. Every mainstream phone shows it. That one second is the whole defence.
- Check the domain, not the page. Attackers copy pages perfectly and cannot copy domains.
- Feel for a sticker on payment codes in public. A raised edge is a red flag.
- Never type credentials or card details on a page you reached by scanning. Navigate to the site yourself instead.
- Treat urgency as a warning. "Scan to avoid a fine" is a pressure tactic, not a service.
- Be wary of shortened links. They hide the destination twice over.
What our scanner does about it
The scanner never opens anything automatically. It shows the full value and the domain, blocks javascript:, data:, file:, vbscript:, blob: and intent: outright, and flags characteristics worth checking: plain http, link shorteners, raw IP addresses, punycode domains that can imitate a brand, an "@" before the domain, and unusual subdomain depth. These are characteristics, not verdicts — we cannot tell you a site is malicious, only that something about it deserves a look.
If you publish codes
- Laminate or otherwise protect codes in public, and inspect them on a schedule.
- Print the destination domain in text next to the code so people can compare.
- Use your own domain rather than a third-party shortener.
- Prefer static codes: a dynamic code's destination can be changed by anyone who gets into the account.
- Never ask people to enter passwords or card details on a page reached only by scanning.
Sources
Public-sector consumer warnings about QR code fraud are published by, among others, the US Federal Trade Commission and the UK's Action Fraud. The URI schemes this site blocks are defined in the WHATWG URL standard.