Treat every QR code as an untrusted link until you verify where it leads. Scan only when the source is known, the code appears untampered with, and the destination matches what you intended to open. If a code appears in a public place, confirm the URL or use a trusted search instead of entering personal data immediately.
How to decide whether a QR code is safe to scan
A QR code should be treated as a shortcut to a destination you have not yet verified. In public settings, the real risk is not the code itself, but the URL, app, or payment flow it opens. Decide based on source, context, and destination, not on the convenience of scanning.
What makes a public QR code risky?
Public QR codes are easy to replace, overlay, or print on top of legitimate signage. A code on a poster, table tent, parking meter, or flyer can redirect you to a lookalike site, a malicious download, or a fake payment page. The danger increases when the code asks for a login, card details, or other personal data before you have independently verified the destination.
Even when the code points to a real organisation, the route can still be unsafe if the link is shortened, unexpected, or inconsistent with the surrounding context. A trustworthy venue can still have a tampered code, so the deciding factor is whether the destination matches the task you intended to complete.
How to verify a QR code before acting on it
Start with the surrounding evidence. Check whether the code is printed as part of official signage, whether it looks physically altered, and whether the expected destination is obvious from the context. If the code is for a menu, event check-in, or public notice, the destination should make sense without forcing you to accept a surprise login or payment step.
When the target matters, inspect the URL before proceeding. If your scanner previews the link, compare the domain name carefully and look for misspellings, unusual subdomains, or a mismatched brand. For higher-risk actions, open the destination by typing the known site yourself or using a trusted search result instead of following the code directly.
If the QR code appears in a public place and the destination is not already familiar, treat verification as the safe default. This is especially important when the code is paired with urgency, rewards, refunds, account recovery, or notices that try to push you into immediate action.
Risk and Threat Considerations
Public QR codes can be abused as a low-friction phishing path because they collapse visual trust into a single scan. Attackers rely on speed, distraction, and the habit of assuming a printed code is legitimate.
Failure mechanism: A tampered code or spoofed poster sends the user to a fraudulent destination that captures credentials, payment data, or installs unwanted software.
Impact: The result can be account compromise, financial loss, data exposure, or a broader device and identity incident if the user trusts the redirected site.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication and Access Control | Verifying the destination before entering data reduces unauthorized access risk. |
| Recommendation — Require verified destinations before users submit credentials or sensitive data. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | Users should validate the QR destination before trusting the input path. |
| Recommendation — Validate user-facing links and destinations before action. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | QR-driven phishing often aims to steal login credentials at a fake destination. |
| Recommendation — Protect authentication flows against lookalike destinations and credential capture. | ||
| NIST SP 800-63 | Digital Identity Guidelines | Phishing-resistant verification matters when a QR code launches an authentication flow. |
| Recommendation — Use phishing-resistant sign-in methods when QR flows lead to authentication. | ||
Practitioner Guidance
What to verify: For any public QR code, verify the destination URL, the physical integrity of the code placement, and whether the action required matches the surrounding context. If the code asks for more trust than the setting justifies, stop and use a manually entered address or a known official app.
Decision rule: If the code leads to a login, payment, download, or data-entry page that you were not already expecting, do not scan first and think later. Verify the destination through a separate channel before you continue.
Practitioner takeaway: The safest habit is to treat QR codes as untrusted until the destination is independently confirmed, because the risk sits in what the code opens, not in the code image itself.
Related resources from NHI Mgmt Group
- How do organisations decide whether to scan Rust code in the CI pipeline or only before release?
- How should teams decide whether to use generated auth code in production?
- How should security teams decide whether an identity-related code finding is actually exploitable?
- How should teams decide whether to pair code review tools with runtime testing?
