QR Code Security: Best Practices

Because you cannot read a QR code with the naked eye, they inherently require a leap of faith. You point your camera, click a link, and trust it takes you where it promises. Malicious actors have realized this and started exploiting QR codes in attacks known as "Quishing" (QR Phishing).

Here is a guide to QR code security best practices for both consumers and businesses.

The Anatomy of a QR Attack (Quishing)

A QR code itself cannot contain a virus. It is simply a vehicle for data (usually a URL). The danger lies in where that URL takes you.

Attackers will print fake QR codes on stickers and place them over legitimate QR codes—like on parking meters, restaurant tables, or electric vehicle charging stations. When you scan the sticker, it takes you to a fake website that looks identical to the real one, prompting you to enter your credit card details or login credentials.

Best Practices for Scanning QR Codes (Consumers)

1. Inspect Physical Codes

If you are scanning a printed QR code in a public place, run your thumb over it. Is it a sticker plastered over the original menu or parking meter? If so, do not scan it.

2. Check the URL Preview

When you scan a QR code, your smartphone camera will show a preview of the URL before you tap it. Look closely at this domain. If the parking meter is run by the city, but the URL is `http://pay-parking-city-xyz.com`, it is likely a scam.

3. Don't Download Apps from QR Codes Directly

If a QR code prompts you to download a `.apk` file or install an app directly from the browser, decline it. Always navigate to the official Apple App Store or Google Play Store to download apps.

Best Practices for Generating QR Codes (Businesses)

1. Brand Your Codes

A standard black-and-white QR code is easy to replicate. Use a custom QR code generator to embed your company logo in the center and use your brand colors. This makes it much harder for a scammer to quickly print a convincing fake sticker to slap over yours.

2. Educate Your Customers

If you use QR codes for payment or sensitive information, put a warning nearby. For example: "Our menu QR code will only ever direct you to `www.ourrestaurant.com/menu`. We will never ask for payment details via this link."

3. Use Custom Domains for Dynamic Codes

If you use dynamic QR codes (which use a redirect link), ensure the redirect link uses your brand's domain name if the service allows it, rather than a generic URL shortener that looks suspicious.

Conclusion

QR codes are incredibly useful tools, but they require the same level of skepticism as email links. By taking two seconds to inspect the code and the destination URL, you can easily avoid falling victim to QR phishing.