"Can QR codes be hacked?" comes up every time a news story runs about QR fraud. The short answer: the code itself can't be hacked, but the system around it can be exploited.
Here's what real QR security threats look like and how to protect your business.
The Three Main QR Threats
1. Quishing (QR Phishing)
An attacker sends or posts a QR code that looks legitimate (appears to go to a bank, shipping carrier, or service) but actually redirects to a phishing site that steals credentials.
Example: A fake "parcel delivery" notice mailed to homes with a QR code → scanner lands on a convincing-but-fake shipping login page → credentials stolen.
Business risk: if your customers are trained to trust QR codes from "your company," they're more vulnerable to quishing.
2. Sticker Attacks
An attacker prints a QR sticker with their own malicious URL and physically pastes it over a legitimate QR code on a sign, menu, or parking meter. Scanners get redirected to a phishing or malware page.
Example: Parking meter QR codes in Austin, TX were covered with fraudulent stickers in 2024, directing people to fake payment portals.
Business risk: if your public-facing QR codes can be stuck over, they can be weaponized against your customers.
3. Brand Impersonation
An attacker creates a fake website that mimics your brand and generates QR codes that redirect to it. They distribute these QRs via email, social media, or printed materials.
Business risk: reputation damage and liability if customers think the fake is yours.
How QR Codes Themselves Are (and Aren't) Secure
The QR pattern is just a URL encoding. It can't execute code. It can't install anything. Scanning a QR is equivalent to clicking a link.
The security depends on:
- Where the URL points
- Whether users trust the redirect
- What the destination page does
Treat QR codes exactly like links in an email. Same threat model, same defenses.
How to Protect Your Customers
1. Use Your Own Domain in Redirects
If your dynamic QR codes redirect through bit.ly/xyz or qr-gen.com/abc123, customers can't verify legitimacy. If you use yourbrand.co/qr instead, they can see at a glance the redirect is yours.
2. Tamper-Resistant Placement
For public-facing QR codes:
- Laminate printed QR codes so stickers are obvious when added
- Engrave on metal for outdoor permanent signs
- Embed under glass for counter-top signs
- Audit regularly — check weekly that QRs haven't been covered
3. Publish the Expected URL
On the QR sign, print the expected domain in text: "QR goes to yourbrand.com." Customers can compare what their phone shows after scanning to what you published.
4. Use HTTPS Everywhere
Every URL a QR points to should be HTTPS. Browsers warn on HTTP, which customers read as "this business is shady."
5. Warn About Fakes
If your brand is big enough to be impersonated, add a page on your site listing legitimate QR code locations and warning customers about impersonators.
How to Protect Yourself as a Scanner
The advice your customers need:
- Preview the URL before tapping (iOS and most Androids show the URL first)
- Check for typosquatting (
amaz0n.cominstead ofamazon.com) - Be suspicious of QR codes in unexpected places (random stickers, flyers in public spaces)
- Never enter credentials on a page reached via QR unless you verify the domain
- Use a phone with built-in QR preview (most modern phones have this)
For High-Value QR Use Cases
If your QR code's destination handles money, credentials, or sensitive data:
Signed Redirects
Attach a signature to the redirect URL (e.g., yourbrand.com/pay?ref=abc123&sig=xyz) that your server verifies. Fake QRs without the right signature get rejected.
Short-Lived QR Codes
For transactions, generate a QR that expires in 5-15 minutes. Even if a bad actor screenshots and redistributes it, the code is already dead.
Rate Limiting
If a single QR's endpoint sees 1000 hits in a minute, something's wrong. Rate-limit per-code to catch abuse early.
Monitoring Unusual Redirects
Track scan locations via IP geolocation. If a QR meant for in-store scanning in Boston starts getting thousands of hits from overseas IPs, investigate.
Myth: "Scanning a QR Code Can Install Malware"
Not on any mainstream phone made in the last decade. Scanning a QR opens a URL. The URL can lead to a malicious site, but the site still needs to exploit a browser bug or trick the user into downloading something. The QR itself is inert.
Where this myth comes from: early 2010s "QR codes install trojans!" articles that conflated "opening a malicious link" with "the QR itself is the malware." It's not.
Business Owner's Security Checklist
- All public QR codes use HTTPS destinations
- Short URLs use your own domain
- Expected destination URL is printed near the QR code
- Public-facing QRs are laminated, engraved, or protected
- Weekly visual audits of physical QR placements
- Your dynamic QR provider supports analytics (so you spot anomalies)
- You have a plan for what to do if a QR is tampered with
QR security isn't complicated — it's about treating QRs like the URLs they actually are, and securing the full scan → redirect → destination chain.
Ready to create QR codes?
Generate custom QR codes with landing pages, analytics, and more.
