QR Code Security: Avoiding Malicious Codes and Phishing

By QRCraft · August 10, 2026 · 6 min read

A QR code is a convenient way to encode a URL — and that is exactly why it is also a convenient way to hide one. When you scan a code, you cannot tell where it leads until the camera reads it, and that gap between scan and destination is the entire attack surface. This article covers how malicious QR codes work, the most common attack patterns, and the practical habits that keep you safe without giving up the convenience of scanning.

How Malicious QR Codes Work

A QR code does not "do" anything by itself — it encodes a string, and what happens next depends on the scanner. The most common string is a URL, and the most common malicious pattern is to encode a URL that points to a phishing site: a fake login page for a bank, a fake payment portal, or a fake package-tracking page that asks for credentials. Because the URL is hidden inside the code, the attacker can put a legitimate-looking sticker over a real code in a public place — on a parking meter, a restaurant table, a poster — and a victim who scans it never sees the destination until the browser opens.

More sophisticated attacks chain redirects: the code points to a legitimate-looking short URL that then bounces through several hops before landing on the phishing page, defeating simple URL blocklists. The QR code itself is harmless; the harm is at the destination, and the code's only role is to obscure the destination long enough for the user to scan.

QR Phishing (Quishing) Attacks

Quishing is phishing that uses a QR code instead of an email link. The attacker sends an email with a QR code embedded as an image — "scan to view your invoice," "scan to confirm your delivery," "scan to update your password" — and the user, conditioned to treat email links with suspicion, scans the code with their phone. The phone's camera does not run the same email-security filters the desktop mail client does, so the attack bypasses the URL rewriting, sandboxing, and blocklisting that protect links inside email bodies.

Quishing has grown sharply because it works. The victim scans a code that looks routine, the phone opens a browser to a phishing page that looks legitimate, and the user enters credentials the attacker now controls. The same email-security tooling that flags suspicious links in text does not see anything inside an image, so the QR code sails past the filters that would have caught the same URL written as a clickable link.

URL Preview Features in Modern Scanners

The defense built into the scanner is the URL preview. When the camera reads a QR code, the phone shows the decoded URL on screen and asks the user to confirm before opening the browser. This is the single most important moment in the security of QR scanning: the URL is visible for a second or two before anything loads, and that is when you should look at it.

The habit to build is simple: never tap the notification without reading the URL. A code that looks like it came from a restaurant menu should resolve to a domain that matches the restaurant. A code on a parking meter should resolve to the city's payment provider, not a look-alike domain with a letter swapped (paypa1.com instead of paypal.com). If the URL is a short link that hides the destination, treat it with extra caution; legitimate payment and login sites rarely hide behind short links.

Best Practices: Check Destination Before Opening

• Read the URL in the preview before tapping. The preview exists for exactly this reason. Match it to what you expected to scan.
• Treat short links with suspicion. A code that resolves to a short URL is hiding its destination. If you cannot tell where it leads, do not tap.
• Be cautious with stickers placed over printed codes. A sticker overlay on a public code is the easiest physical attack vector. If a code looks like it was stuck on top of another code, do not scan it.
• Do not enter credentials after a QR scan unless you expected to. A code you scanned to read a menu should not be asking for a login. If it does, close the browser.
• Use a scanner app that previews, not one that auto-opens. Some dedicated scanner apps open the URL immediately on read. Prefer the native camera on modern phones, which previews by default.

Enterprise QR Security Policies

For organizations, the risk is not just individual users but the systems they connect to. A malicious code scanned by an employee can lead to a credential theft that opens the door to email, the VPN, or a SaaS app with broad access. The policies that mitigate this are mostly extensions of existing security controls:

• Filter QR codes in email. Modern email security gateways can flag or block messages containing QR code images, or rewrite embedded codes the way they rewrite links. Treat a QR code in email with the same suspicion as a clickable link.
• Enforce MFA on every external-facing system. A stolen credential is useless to the attacker if the second factor still blocks the login. Phishing-resistant MFA (FIDO2 keys, passkeys) is the right choice for anything that matters, because it verifies the domain cryptographically and refuses to authenticate on a look-alike.
• Train users on the preview habit. The single most effective user control is the habit of reading the URL in the scanner preview before tapping. Make it part of security awareness training.
• Block known-bad destinations. Even with previewing, users will sometimes tap. DNS filtering and secure web gateways that block known phishing domains are the backstop that catches the click that should not have happened.

Summary

A QR code's security risk is that it hides a URL until it is scanned, and that is enough to defeat the suspicion most users apply to clickable links. Malicious codes redirect to phishing pages, and quishing — phishing via QR codes embedded in email — has grown precisely because it bypasses email link filters. The defenses are layered: read the URL in the scanner preview before tapping, treat short links and sticker overlays with extra caution, never enter credentials on a page a QR scan led to unless you expected to, enforce phishing-resistant MFA on the systems that matter, and filter QR codes in email the same way links are filtered. The convenience of QR codes is worth keeping; the habit of checking the destination before opening is what makes it safe to keep it.