A QR code is a two-dimensional barcode that stores data in a machine-readable pattern of black and white modules. Scanners decode the pattern into text, links, or other data. Attackers abuse malicious QR codes to direct users to phishing sites or trigger unwanted actions, so organisations should inspect where codes are used and what they resolve to.
How QR codes encode information
A QR code is a compact matrix of black and white modules arranged in a square grid. Those modules are not decorative, they represent data and error-correction information that a scanner can read from any angle. That design is what makes QR codes quick to scan and resilient enough to keep working when partially damaged or obscured.
The pattern includes finder markers and timing patterns that help the scanner locate the code, determine its orientation, and interpret module positions correctly. Once the image is captured, decoding software converts the visual pattern into bytes and then into the original content, which might be plain text, a URL, a payment instruction, or another machine-readable payload.
What happens when a scanner reads a QR code
When you scan a QR code, the camera or reader first isolates the square, corrects for rotation and distortion, and samples the black and white cells. The software then applies the QR specification to reconstruct the data stream, verify the error-correction blocks, and recover the embedded message even if part of the code is dirty or clipped.
What the user experiences next depends on the encoded payload. A text-only code may simply display information, while a web link may open a browser, a payment code may populate a transaction, and an app-specific code may launch a workflow. The scanner does not usually “judge” intent, it just turns the encoded pattern into the action the payload requests.
Why QR codes are useful and where they go wrong
QR codes are useful because they move information from a physical or visual format into a digital action with very little friction. That convenience is also why they are attractive for phishing and other abuse, because the visible code hides the destination until after the scan. In practice, the code becomes a delivery mechanism, and the real security question is what it resolves to and whether that destination is trustworthy.
Attackers exploit that trust gap by replacing legitimate codes, redirecting users to spoofed sites, or using images in email, posters, parking meters, invoices, and PDFs to bypass cautious link inspection. A QR code can also act as an indirection layer, so the person scanning may never see the true destination before a browser or app has already started interacting with it.
Risk and Threat Considerations
QR codes are low-friction enough that users often scan first and verify later, which makes them effective for phishing, payment diversion, and malicious redirects. The main risk is not the barcode itself, but the hidden destination or action encoded inside it.
Failure mechanism: An attacker substitutes a benign-looking QR code with one that resolves to a fraudulent site, malicious deep link, or unwanted workflow, then relies on rapid mobile execution and limited user visibility to defeat manual inspection.
Impact: Users can be sent to credential harvesters, exposed to account takeover attempts, or tricked into authorising payments or app actions before they realise the code was malicious.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1566 — Phishing | QR-code phishing is a delivery variant of phishing and social engineering. |
| Recommendation — Map QR-code lures to T1566 and monitor for credential-harvest and redirect patterns. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | QR scans need destination and action validation before trust or execution. |
| SC-23 — Session Authenticity | Malicious QR flows can redirect users into hostile sessions or lookalike workflows. | |
| Recommendation — Validate scanned QR destinations before allowing downstream actions. Require authentic, user-verifiable session transitions after QR-based redirects. | ||
| CIS Controls v8 | CIS-14 — Security Awareness and Skills Training | QR-code abuse is primarily a user-facing social-engineering technique. |
| Recommendation — Train users to inspect QR destinations before they scan or submit data. | ||
| OWASP ASVS | V10 — OAuth and OIDC | QR-based login and app-link flows can trigger authentication handoffs and consent abuse. |
| Recommendation — Harden QR-driven auth flows with explicit issuer and redirect validation. | ||
Practitioner Guidance
What to verify: Treat the destination as the control point, not the image. If the code is used for login, payment, or account recovery, verify the resolved URL, app handoff, or transaction details before trusting it, and prefer environments where the destination can be previewed or centrally managed.
Common mistake: Many teams only validate the printed artefact or sticker placement and ignore the full scan path. That misses the real abuse case, which is a legitimate-looking code that resolves to a hostile destination.
Practitioner takeaway: QR codes are secure as a data format, but security depends on destination governance and user verification, especially when the code can initiate authentication, payment, or account-related actions.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org