QR code security and privacy

Quishing, malicious stickers, what a QR code can and cannot do to your phone, and what your generator can see.

• Are QR codes safe?Scanning a QR code is safe in itself — it decodes text and nothing else. The risk is entirely in what you do next. A code cannot install software, dial,…
• Can a QR code install malware?Not by itself — a QR code is text and nothing executes on scan. The real infection chains all need your confirmation or an unpatched phone. Here they are.
• Can a QR code steal your data?The code reads nothing — theft happens at the destination. Phishing forms, OAuth consent abuse, hostile WiFi: the actual mechanisms and the habits that beat them.
• Dynamic QR codes and privacy — what every scan revealsEvery scan of a dynamic QR code transits the provider's server, which can log IP, device and time. What is collected, what to ask, and when static is safer.
• Fake menu QR scams — table-tent swaps in restaurantsA sticker over a table's menu code sends diners to a cloned menu or ordering page that harvests cards. Why restaurants are exposed and the owner checklist.
• How to check where a QR code goes before opening itUse the preview banner both iOS and Android show before opening, and read the domain immediately before the first single slash. To inspect without any…
• How to spot a malicious QR codeA malicious code looks identical to a real one, so judge context and destination instead. The physical tells, the digital tells, and how to decode safely.
• Parking QR code scams — how they work and how to avoid themFake QR stickers on parking meters lead to card-harvesting payment pages. What the FTC and FBI have warned about, and the rules for drivers and operators.
• QR code scams on packages and mailUnsolicited parcels and letters carrying QR codes are a documented scam vector. The missed-parcel lure, brushing packages, and the safe-handling rules.
• QR code stickers placed over real ones — the overlay attackThe cheapest QR attack is a printed sticker pasted over a genuine code. Why it works, where it happens, and what venues can do to make overlays obvious.
• QR codes and tracking — what is actually loggedWhat a scan reveals depends on architecture. Direct static codes show a normal visit; shorteners and dynamic codes log IP, device and time. The honest table.
• QR codes in phishing emailsWhy phishers put QR codes in email: the image slips past URL filters, and the scan moves you to an unmanaged phone. The lures, the journey, the defences.
• Quishing: QR code phishing explainedQuishing is phishing delivered by QR code. It works for two structural reasons: a human cannot read a URL from a pattern before scanning it, and email…
• Should you scan QR codes in public?Scanning is safe in itself — the risk is the destination and what you type there. A practical risk ranking from menus to payment codes to prize stickers.
• What a QR code can and cannot do to your phoneA QR code is inert text — it cannot install, execute or read anything. What each payload type actually triggers, and where the real risk chain begins.
• What your QR code provider can seeA server-side QR generator receives your payload at creation and standard server logs record it. What providers see at creation, at scan and at account level.
• Why QR phishing bypasses email filtersEmail gateways parse text — URL rewriting, reputation checks, sandboxing. A QR code is pixels, so the URL skips the pipeline. Inside the arms race.
• Why you should not upload a WiFi password to a websiteA WiFi QR form on a server-side generator transmits your network name and password to someone else's server. The fix is architectural — client-side generation.
• An enterprise QR code policy you can adoptAn adoptable enterprise QR policy — approved generators, own-domain rules, design standards, a code registry, audit cadence and an incident playbook.
• Client-side vs server-side QR generation, and why it mattersIf a QR generator renders the image on its server, your data — including WiFi passwords, contact details and payment identifiers — is transmitted to and…
• OTP secret exposure — the 2FA screenshot problemScreenshotting a 2FA setup QR stores the secret in your camera roll and cloud sync. Why deleting the photo is not enough, and how to rotate the secret properly.
• QR codes and GDPR — when a scan becomes personal dataWhen a QR flow processes personal data under GDPR — scan logs, lawful basis, notices at the code, and the static-direct design that avoids processing entirely.
• QR codes and PCI DSS — what is actually in scopeUPI, PIX and EPC codes carry account references, not card numbers — largely out of PCI scope. Where QR payment flows do and do not touch PCI DSS.
• QR codes in HIPAA contexts — keeping PHI out of the pixelsNever encode PHI in a QR code — a printed code is plain text forever. Safe token patterns, the BAA question for providers, and why wristbands get it right.
• QR codes in security awareness trainingHow to run simulated QR phishing — placements, measurement with static codes and UTM parameters, the ethical line, and teachable-moment landing pages.
• Signed QR codes and authenticityHow signed QR codes prove who issued a code and that it was not altered — the JWS pattern, the EU Digital COVID Certificate, SQRC, and a build sketch.
• Tamper-evident QR labelsDestructible vinyl, void laminates and holographic overlays make QR sticker swaps visible for pennies per label — if you pair them with a physical audit routine.
• The security model of 2FA setup QR codesThe 2FA setup QR carries your shared secret in plain text, shown once. What the otpauth URI contains, how TOTP works, and how to handle the exposure window.