Advanced Topics
QR Codes and Security
A QR code cannot contain a virus. It holds text, and text doesn't execute. What it can do is hide a destination behind a pattern no human can read — and that single property, opacity, is the whole of QR security. Every real attack is a variation on "the code went somewhere other than where you assumed."
The short version
- A QR code can't carry malware. It carries text; the risk is where that text points.
- Opacity is the vulnerability — you can't read a code before following it.
- Quishing is mostly physical: a sticker over a legitimate code.
- Read the preview before tapping. Every modern phone shows one for this reason.
- If you publish codes, you have an asset in public that someone can cover.
- Never enter credentials on a page you reached by scanning something unexpected.
What a QR code can and can't do
Worth being precise, because the "QR codes can contain viruses" claim circulates persistently and is wrong.
A QR code encodes a string. When scanned, the phone decodes it and offers an action based on what the string looks like — open a URL, save a contact, join a network. At no point is code executed. There is no mechanism by which the pattern itself installs anything.
What it can do is point at something hostile. And because the pattern is unreadable to humans, you cannot evaluate it before acting — which is a genuine, structural weakness that doesn't exist with a printed URL.
Decoders are software, and software has bugs — a maliciously malformed code could in principle target a vulnerability in a scanning app. This is rare, has affected specific third-party apps rather than the platform cameras, and is a strong argument for using your phone's built-in scanner rather than an app from a search result. It remains a distant second to the real risk, which is the destination.
How attacks actually work
Sticker-over-sticker (quishing)
The dominant attack, and it's physical rather than technical. Someone prints a code pointing at a page they control and sticks it over a legitimate one. Parking meters, restaurant tables, EV chargers, transport posters and charity collection points are the usual targets — anywhere a code is unattended, payment is plausible, and the victim has no baseline for what the correct destination looks like.
The landing page then imitates the real service and asks for card details. Nothing was hacked; a sticker was applied.
Codes in email and messages
Increasingly common in phishing, for a specific reason: a QR code in an image evades link-scanning filters that would have caught the same URL as text. It also moves the victim onto a phone, which typically has weaker endpoint protection and a truncated address bar. An unexpected code in an email asking you to "verify" something is a strong signal of phishing.
Malicious payload types
- Wi-Fi codes that join a network the attacker controls.
- SMS codes pre-filled to a premium-rate number, hoping you tap send without reading.
- Contact codes that install a plausible-looking but wrong entry — a bank's name against the attacker's number.
- Deep links that open an installed app in an unexpected state.
All of these still require you to confirm. Every platform requires a tap before joining a network, sending a message or saving a contact — which is exactly where the defence lives.
If you're scanning
- Read the preview. Every modern phone shows the destination before opening it, specifically so you can check. Look at the actual domain, not the words around it.
- Be suspicious of stickers. A code applied on top of printed material — different paper, slightly crooked, a raised edge — is the single clearest warning sign. Real codes are usually printed as part of the design.
- Never enter payment or credentials on a page reached from an unexpected code. Navigate to the organisation yourself instead. This one habit defeats nearly every quishing attempt.
- Treat codes in email as hostile until proven otherwise, particularly ones creating urgency.
- Use the built-in camera, not a scanner app from a search result.
- Shortened links deserve extra care. They're legitimate and normal for dynamic codes, but they hide the final destination until you arrive.
More device-specific guidance in how to scan a QR code.
If you're publishing codes
This side gets less attention and is where your actual exposure sits: you have an asset in public that someone can cover, and your customers will blame you.
- Print codes as part of the material, never as an applied sticker. A printed code makes tampering visible; a sticker over a sticker doesn't.
- Check unattended codes on a schedule. Anything in a public place — collection tins, table signage, window decals, outdoor boards — should be physically inspected and scanned periodically. Nobody will report a swapped code to you; they'll just be defrauded.
- Tell staff what the correct destination looks like. A volunteer who knows the URL should start with your domain can spot a swap in a second.
- Use your own domain for the short URL where possible. It's a verification anchor for customers and it removes a third-party dependency.
- Print the destination in text alongside the code. Costs a line, gives people a way to verify and a route if they won't scan.
- Watch your scan analytics for anomalies. A code that suddenly stops registering scans may have been covered.
The largest single risk in a dynamic-code setup isn't a sticker — it's your provider account. Someone with access can repoint every code you have ever printed, simultaneously, to anywhere they like, and your printed material becomes an attack distribution channel you cannot recall.
Use strong, unique credentials and enable multi-factor authentication. Review who has access, especially after someone leaves. And keep an exported record of the correct code-to-destination mapping, so you can detect and reverse a mass repoint rather than reconstructing it from memory.
The static/dynamic security trade-off
Neither is simply safer — they fail differently, and it's worth choosing deliberately.
| Static | Dynamic | |
|---|---|---|
| Destination can be changed by an attacker | No — it's in the ink | Yes, if the account is compromised |
| Can be fixed if the destination is compromised | No — reprint only | Yes, in seconds |
| Blast radius of one compromise | One code | Every code on the account |
| Destination visible in the preview | Yes, the real URL | A short URL only |
| Depends on a third party staying honest | No | Yes |
Roughly: a static code cannot be turned against you remotely, but cannot be rescued either. A dynamic code can be repaired instantly and can be subverted at scale. For most commercial use the repairability wins — but it makes account security a first-order concern rather than an afterthought.
Frequently asked questions
Can a QR code give you a virus?
No. A QR code stores text, and text doesn't execute — there is no mechanism by which the pattern installs anything. The real risk is that the text is a link to a malicious site and that you follow it without reading the destination first. Every modern phone shows a preview before opening precisely so you can check, which makes reading that preview the single most effective defence.
What is quishing?
Phishing carried out through a QR code. The most common form is physical: someone prints a code pointing at a page they control and sticks it over a legitimate one — on a parking meter, a restaurant table, an EV charger, a collection tin. The fake page then imitates the real service and asks for payment details. It's also increasingly used in email, because a code inside an image slips past link-scanning filters that would have caught the same URL as text.
How can I tell if a QR code is safe before scanning?
You can't read the code itself, so check two other things. Physically: does it look applied rather than printed? A sticker over existing material, slightly crooked or on different paper, is the clearest warning sign. Then scan but don't tap — read the destination in the preview and check the actual domain. If you're being asked for payment or credentials and didn't expect to be, navigate to the organisation yourself instead.
Are QR codes on restaurant tables and parking meters safe?
Usually, but they're the classic targets precisely because they're unattended, payment is plausible, and customers have no baseline for the correct destination. Check whether the code is printed into the material or stuck on top, and read the preview before tapping. If it asks for card details and the domain doesn't obviously belong to the business, stop and pay another way.
How do I protect the QR codes my business publishes?
Print codes into the material rather than applying stickers, so tampering is visible. Inspect unattended public codes on a schedule — nobody will report a swapped code, they'll just be defrauded. Print the destination in text alongside so customers can verify. And treat your dynamic-code provider account as critical infrastructure with multi-factor authentication: someone with access can repoint every code you have ever printed at once, and you cannot recall printed material.