QR Code Security: Risks, Defenses and a Checklist

A QR code is not dangerous in itself. It is a picture that holds a web address, and the risk sits in where that address leads and who controls the path to it. For anyone scanning, the defense is to look at the destination before you act. For a brand that prints QR codes, the defense is to own the domain, the redirect and the DNS records behind every code. This guide covers both sides.

What actually makes a QR code unsafe#

Security guidance from Duke University’s information security office^[1] puts it plainly: the code itself poses little risk, but the target it points to may. A QR code also hides its destination from human eyes, which is why it works so well for attackers. You can read a suspicious link in an email. You can’t read a square of black and white modules.

The Canadian Centre for Cyber Security^[2] notes that a scan can trigger more than a web page. Depending on the code, it can open a site, download an app, join a Wi-Fi network, create a contact, or send a message. That is a wider surface than most people assume.

That gives us four distinct places where things go wrong:

1. The code is swapped. A criminal places a sticker over a legitimate code.
2. The code is delivered through a channel that bypasses filters. This is quishing.
3. The destination changes. The page behind a valid code is replaced or compromised.
4. The path is hijacked. A redirect, subdomain or account that the code depends on falls into someone else’s hands.

The first two mostly concern people who scan. The last two mostly concern the organizations that publish codes. Most guides stop at the first two, which is why the brand side deserves more attention.

How the main attacks work#

Quishing: phishing delivered as an image#

Adobe’s QR security guidance^[3] describes quishing as embedding malicious QR codes in phishing emails. Because the code is an image rather than a clickable URL, it can slip past traditional email security filters. Adobe also reports that quishing grew 587% in 2023 and made up 22% of all phishing attacks that year.

The FBI’s January 2026 FLASH alert on Kimsuky^[4] shows the targeted version. North Korean state-sponsored actors sent spear-phishing emails to think tanks, academics and government-linked organizations with embedded QR codes. The tactic moves the victim from a machine secured by enterprise policy to a mobile device that may not have the same protections. The same alert describes follow-on theft of session tokens and cloud account takeover. The practical point for IT teams: the attack is built to get around the controls you already have.

Sticker overlays in public places#

The FBI warned back in January 2022 that criminals tamper with QR codes^[5] to redirect victims to sites that steal login and financial information. The usual targets are parking meters, restaurant tables, and anything else where a code invites a quick scan.

Keep the scale in perspective. The UK’s National Cyber Security Centre argues^[6] that this kind of fraud is relatively small compared with other cyber fraud, and that it tends to happen in open spaces such as stations and car parks, often with social engineering involved. Be careful, not frightened.

Unexpected codes in the mail#

The FTC has flagged a brushing-style scam^[7]: an unexpected package arrives with a note telling you to scan a QR code to find out who sent it or to return it. The code can lead to a phishing site or download malware. If you scanned it and entered credentials, the FTC’s advice is to change your password right away and turn on two-factor authentication.

Domain laundering and redirect chains#

This one is rarely mentioned in consumer advice. An attacker encodes a clean-looking URL, then redirects it elsewhere. A 2025 analysis published on DEV Community^[8] found that roughly 23% of malicious QR codes it examined used a redirect hop to a different root domain than the one originally encoded. The same author points out that a destination can pass a check at creation and be switched to a malicious page later, so one-time screening is not enough.

Dangling DNS and subdomain takeover#

Here the code is perfectly legitimate and the brand is the victim. Doppel’s research on redirection hijacking^[9] describes a common pattern: marketing creates a subdomain such as promo.brand.com and points it by CNAME at a temporary third-party vendor. The campaign ends and the vendor account is deleted, but the CNAME stays in corporate DNS. An attacker can claim the abandoned target and silently control where every printed code goes, under the brand’s own name.

That is the worst case for a printed asset. You can’t recall ten thousand flyers.

How to check whether a QR code is safe to scan#

This is the part for everyone, including your employees and customers.

1. Look at the physical code. Check whether it is a sticker placed over another code, or whether the edges look peeled or misaligned.
2. Preview before you open. Use a scanner that shows the full URL, and read it. Check the domain, not just the first few characters. Look for lookalike spellings and unfamiliar domains.
3. Distrust urgency. A code that demands payment, a login, or a “verify your account” step deserves a second look. Go to the company’s official site or app by typing it yourself.
4. Be careful with email. If an email asks you to scan a code to sign in, confirm through another channel. The FBI guidance^[4] identifies this as a way around standard email defenses.
5. Skip codes that arrive unasked. That covers packages, letters and stray flyers.
6. Never enter passwords or card numbers on a page you reached by scanning unless you have confirmed the domain is the real one.
7. If you slipped, change the affected password, enable multi-factor authentication, and contact your bank or IT team if money or work accounts were involved.

If you land on a short link and can’t tell where it goes, you can expand it first. Our free short URL expander shows the destination without you visiting it blind.

What IT and security teams should do#

The FBI and CISA direction for enterprises, as summarized in the 2026 alert, is to adopt phishing-resistant MFA, meaning FIDO-based keys or passkeys, rather than SMS or legacy push approvals. Those weaker methods are exposed to session token theft triggered by quishing. The alert also treats mobile devices as high-risk entry points, recommending that organizations use mobile device management to inspect QR-linked URLs before access is granted. Read the full FLASH^[4] before you set policy, since details evolve.

Beyond that, three habits help:

• Train for QR specifically. Awareness programs often cover links and attachments but forget codes.
• Include QR codes in phishing simulations, so staff practice the check on a phone, not a desktop.
• Assume personal phones are in play. A code scanned off a corporate screen onto a personal device leaves your logging.

What brands should do before printing a code#

If your company publishes QR codes on packaging, signage, mailers or product manuals, you own part of the trust problem. Customers can’t tell your code from a sticker. What you can control is the path behind it.

Use your own domain, not a shared shortener#

A code that resolves through a shared shortener inherits that shortener’s reputation and risk. If the domain is blocklisted because of someone else’s abuse, your codes may stop working. A code on a domain you own looks recognizable when previewed and stays under your control. Our guide to creating a QR code with your own domain walks through the setup.

Prefer dynamic codes for anything printed#

A static code bakes the destination into the pattern. If that page is compromised, retired or mistyped, the only fix is reprinting. A dynamic code points to a short redirect you control, so you can change or disable the destination later. We explain how in changing a QR code destination after printing.

This is a security feature as much as a convenience. If a landing page is compromised or a promotion ends, you redirect traffic to a safe page in minutes.

Audit every hop, repeatedly#

The DEV Community analysis argues that a secure platform should record and inspect every hop of a 301 or 302 sequence server-side, before the scanner’s device reaches the final URL, and keep doing so over time. For your own program, apply the same logic:

• Keep redirect chains short, ideally one hop.
• Review destinations on a schedule, not only at launch.
• Alert on destinations that change root domain.
• Log who changed what, and when.

Every extra hop is another request before the scanner sees the page. In RedirHub's benchmark of 26 redirect providers, measured from Washington, D.C., Frankfurt and Tokyo between 16 and 23 October 2026, the fastest provider's median time to first byte was 11 ms and RedirHub's was 17 ms (RedirHub redirect speed benchmark, 16–23 October 2026^[10]). A chain repeats that wait for each hop.

Put DNS governance around campaigns#

Doppel’s research recommends that IT security approve any new custom subdomain before it exists, and that teams enforce a decommissioning step so CNAME records are removed as soon as a campaign expires. Treat it like a short change-management checklist:

Lock down who can edit#

The same Doppel research describes attackers gaining administrative access through credential stuffing, spear phishing or OAuth token hijacking, then changing destinations. So protect the account that edits your codes: strong MFA, role-based access, and single sign-on for larger teams.

Collect analytics without creating a privacy problem#

Scan data is useful, but it is also data. One engineering perspective on privacy-conscious tracking^[11] recommends aggregating at the link or campaign level, truncating identifiers like IP address and user agent, and keeping analytics separate from user identity. That is a sound baseline. For measurement methods, see our guides to tracking QR code scans and QR code tracking without reprinting.

Our perspective: control the path, not just the picture#

We build link and redirect infrastructure, so we see the same pattern in security incidents again and again. The conversation fixates on the square. The real exposure sits in the plumbing: a shared domain you don’t control, a subdomain nobody remembers, a destination nobody reviews, an account nobody locked down.

Our position is simple. Every code your company prints should resolve on a domain you own, served over HTTPS, with a destination you can change without touching the printed material. That is the whole reason we run branded links and dynamic QR codes on the customer’s own domain rather than on a shared shortener. It means that when a landing page needs to be pulled at 5 p.m. on a Friday, one edit fixes every code in circulation.

We would also say, plainly, that no tool replaces process. Marketing moves faster than DNS governance in most companies. The fix is organizational: someone in IT security approves new subdomains, someone owns the end date, and someone removes the record when the campaign ends. A platform can make that easy to follow. It can’t make anyone follow it.

A dynamic code is also not a shield against a bad destination. If you point it at a compromised page, it will send people there reliably. Review what sits behind the code as carefully as you review the code.

Where RedirHub fits#

If you manage QR codes, branded links or redirects across several campaigns or brands, RedirHub lets you run them under your own domain with automatic HTTPS, change destinations after printing, and see scans in analytics. Our dynamic QR codes can change their destination after printing. Core is $49 per month and Pro is $119 per month; on Pro, optional add-ons are Single Sign-On at $200 per month, Custom Name Servers at $100 per month and a Dedicated Cluster at $300 per month, and Enterprise is set by contract. See the pricing page for what each includes.

We are built for teams managing campaigns, not for one-off code creation.

A short checklist you can use this week#

For people who scan

• Preview the URL and read the domain.
• Ignore unexpected codes on packages, letters and stickers.
• Don’t log in or pay on a page reached from a code without confirming the domain.

For IT and security

• Move to phishing-resistant MFA where you can.
• Use MDM to inspect QR-linked URLs on mobile devices.
• Add QR scenarios to phishing training.

For brand and marketing operations

• Print only codes on domains you own.
• Use dynamic codes for anything printed.
• Keep one owner and one end date per campaign subdomain.
• Remove DNS records when a campaign ends.
• Review destinations and redirect chains on a schedule.
• Restrict and log who can edit codes.

If a printed code stops working, the cause is not always an attack. Our note on why a QR code stopped working covers the common non-malicious causes.