Are QR codes safe? Because the codes are visually unreadable by humans, cybercriminals have targeted them to distribute phishing links or force unauthorized app downloads — a tactic known as 'quishing'. How do you scan safely and tell the difference between a secure QR code and a malicious one? This guide covers the common attacks and the habits that stop them.
What Are the Common QR Code Security Risks?
- Malicious Stickers: Attackers print custom stickers and paste them over legitimate QR codes on public parking meters, flyers, or outdoor posters, redirecting unsuspecting users to copycat payment portals.
- Phishing URLs: A scanned code might load a login page disguised as a bank or shipping company, prompting you to input passwords or card numbers.
What Are the Best Security Practices for Users?
Always inspect the physical QR code before scanning to ensure it isn't a sticker placed over another. Verify the preview URL displayed by your camera app before tapping to open it, and never download files or enter credentials on web pages loaded from public QR codes unless you have verified the domain name in the address bar.