QR code security, honestly

A QR code holds a short string of characters. That is the entire capability. It cannot run code, cannot grant permissions, and cannot reach anything on your phone by itself. The largest QR code holds a few kilobytes of text, which is not a delivery mechanism for anything.

Everything that happens next is your phone reacting to that text: opening a link, offering to join a network, offering to save a contact. The risk is entirely in what the text points at and whether you accept the offer.

The most effective attack against printed codes needs no technical skill at all. Somebody prints their own code and sticks it over yours.

It works because the victim has no way to tell. A code is unreadable to humans by design, so a substituted one looks exactly as legitimate as the original, and it inherits all the trust of the place it is stuck to. Parking meters, restaurant tables, charity collection points and payment counters have all been targeted this way, and the money goes to the attacker while the display goes on looking normal.

If you own printed codes in public, this is your problem rather than your customers'. Practical defenses:

• Check them. Physically, on a schedule. A code stuck over another is usually obvious to a fingertip even when it is invisible in a photograph.
• Make substitution harder. Print the code into the surface rather than applying a label, laminate it under the counter surface, or use tamper-evident stock that damages visibly when lifted.
• Print the destination in words next to the code. It gives a cautious customer something to compare against, and it makes a swapped code detectable by anyone who reads.
• Where money is involved, prefer a code that lands on a page bearing your name and branding over one that jumps straight into a payment app, so the customer has a moment to notice a wrong name.

The second pattern is a code in an email, a letter or a poster that leads to a convincing imitation of a login page. It has picked up the nickname quishing, and it exists for a specific reason: the code moves the click from a computer to a phone.

That matters because the defenses are weaker on the phone. Corporate mail filters inspect links in message text and cannot read an image of a code. Phone browsers show a truncated address bar. And a link followed on a personal phone often bypasses the managed network entirely.

• Treat a code in an unexpected message exactly as you would treat an unexpected link, because that is what it is.
• Be suspicious of codes that lead to a sign-in page. Legitimate services rarely need you to authenticate through a scanned code, and if you do need to sign in, navigate there yourself instead.
• Codes printed on letters about parcels, fines, tax and account suspension are a well-worn genre. The urgency is the tell.

The single most useful habit is to use a scanner that shows you the decoded text and waits, rather than opening it immediately. Both major phone platforms show a preview banner with the domain before you tap, and that banner is worth actually reading.

When you read it, read the end of the domain rather than the start. The deceptive part is almost always placed early, where it looks reassuring, in an address whose real host is something else entirely. Anything before the final dotted pair is decoration.

Two things make a destination genuinely hard to judge. A shortened link discloses nothing until you follow it. And lookalike domains substitute characters that render almost identically, so a careful reader can still be fooled. Neither is a reason to panic; both are reasons to be more cautious about a code than about a link you can hover over.

Most attention goes to URLs, but a code can offer other actions and each has its own small risk.

In every case the phone asks before acting. The defense is reading the prompt, which is exactly the step a well-placed code in a plausible location is designed to make you skip.

• Send people to a domain they recognize as yours, ideally your main one. A code that lands on an unfamiliar host teaches your customers that unfamiliar hosts are normal.
• Serve the destination over HTTPS, and check the code you printed actually resolves there, including any redirect chain in the middle.
• Never encode credentials, personal data or anything you would not print in words. The pattern is not encryption; anyone can decode it, and a photograph of it lasts forever.
• Re-scan your own printed codes periodically, from the field rather than from the artwork file. It is the only way you will notice a substitution or a destination that quietly stopped resolving.