QR Code Security Risks

What Can Go Wrong With a QR Code

A QR code is not a link in the way a clickable URL is. It is a machine-readable pattern that encodes a string of data, most commonly a web address. The person scanning the code cannot see where it points until after the action is complete. That single characteristic underpins most of the security risks associated with QR codes in physical spaces.

In a retail shop, museum or event venue, visitors encounter QR codes on signage, product labels, exhibit panels and printed materials. The physical context creates an assumption of legitimacy: a code printed on an official-looking placard beside a museum exhibit feels trustworthy. The security risk lies in the gap between that assumption and what the encoded data actually does when the device processes it.

The risks relevant to organisations deploying QR codes in physical environments fall into several practical categories rather than abstract threats:

• Destination control. A static QR code permanently encodes a single URL. If that URL is later compromised, repurposed or allowed to expire and subsequently registered by a third party, every printed copy in the field now points somewhere harmful. The organisation has no way to update it.
• Redirect chain exposure. Dynamic QR codes solve the update problem by pointing to a redirect service, which then sends the user to the final destination. Each redirect hop is an additional point where the destination could be altered — either through a compromise of the redirect platform itself or through inadequate access controls on who can change the target URL.
• Physical tampering. A malicious actor can place a fraudulent QR code sticker over a legitimate one. In a busy retail or event environment, staff may not notice the substitution quickly. The physical setting still signals trust, but the destination has changed.
• Data-type ambiguity. QR codes can encode more than URLs. A scanned code might trigger a phone call, add a contact, connect to Wi-Fi, draft an email or initiate a payment prompt. If the scanning app does not preview the action before executing it, the user has no opportunity to assess the risk.
• Session and credential exposure. If a QR code encodes a URL containing session tokens, authentication parameters or one-time passcodes, those values are visible to anyone who scans the code or photographs it. In shared physical spaces, this is a genuine concern.

These risks do not mean QR codes are inherently unsafe for proximity deployments. They mean the organisation placing the codes carries responsibility for how the codes are generated, where they point, who controls the redirect path and how the physical installations are monitored.

Controls for Public and Operational Codes

The security profile of a QR code deployment depends heavily on what the code is meant to achieve and how it is managed over time.

Static codes for fixed resources

A museum placing static QR codes on exhibit labels that link to permanent collection pages faces a specific risk: if the CMS URL structure changes, the domain is not renewed, or the page is moved without a redirect, every printed code becomes a dead link or, worse, points to an unintended destination if the domain is later registered by someone else. The security consideration here is long-term domain control and URL stability rather than active attack prevention.

Dynamic codes for campaigns and changing content

Retailers running time-limited promotions often prefer dynamic QR codes because the destination URL can be changed without reprinting. The security consideration shifts to the redirect platform: who has admin access, whether changes require approval, whether the platform logs modification history and what happens if the platform account is compromised. A dynamic QR system is only as secure as the access controls around its management interface.

Payment and transaction codes

QR codes used for payments, whether at point-of-sale terminals or on printed invoices, encode transaction-specific data. The risk here is not typically redirection but interception or duplication. A photograph of a payment QR code could be used to initiate a transaction if the code does not include time-based or single-use constraints. For organisations deploying payment QR codes, the question to put to the provider is what expiry and replay-prevention mechanisms are built into the encoded payload.

Wi-Fi access codes

Venues sometimes use QR codes to share Wi-Fi credentials by encoding the SSID, password and encryption type in a standard format. This is convenient but means the network credentials are permanently embedded in any photograph or screenshot of the code. If the QR code is on a permanent sign, changing the Wi-Fi password requires replacing the physical sign, and any previously captured images remain valid until the old password is deactivated on the access point.

Internal and operational codes

Warehouses and back-of-house areas sometimes use QR codes for asset tracking, maintenance logs or internal system links. The risk profile changes because these codes are not intended for public use, but they may still be physically accessible to visitors, contractors or delivery personnel. Encoding direct links to internal dashboards, unauthenticated endpoints or API calls in QR codes placed in semi-public areas creates an exposure that is easy to overlook.

Incident Checks and User Trust

Several recurring mistakes undermine QR code security in deployed environments, and most are straightforward to address during planning rather than after installation.

Assuming physical placement equals trust

The most common error is treating a QR code as a trusted element simply because the organisation placed it there. Physical placement does not prevent tampering, and it does not guarantee the encoded destination remains correct over time. Trust should derive from verified destination control, not from the presence of a branded sticker.

No process for physical inspection

Organisations frequently install QR codes and have no scheduled process for checking that the physical codes have not been altered, covered or replaced. In high-traffic retail or event environments, a tampered code could remain in place for days. A practical mitigation is to include QR code locations in routine visual checks, alongside other signage and fixture inspections.

Ignoring redirect-chain length

Some dynamic QR services add multiple redirects between the scan and the final destination. Each hop introduces latency, a potential point of failure and an additional party who could alter the destination. When evaluating a dynamic QR provider, check how many redirects occur between the encoded URL and the landing page, and whether the provider publishes details of their redirect architecture.

No expiry or revocation capability

Static codes, by definition, cannot be revoked. Dynamic codes can often be disabled, but only if the management platform supports it and someone remembers to do so. For event-specific QR codes — conference schedules, temporary wayfinding, one-day promotions — the ability to deactivate the code after the event closes is a basic security control that should be confirmed before deployment.

Key checks before deployment

• Protocol. Does the encoded URL use HTTPS? A code pointing to an HTTP destination allows interception of any data the user submits on the resulting page.
• Domain ownership. Does the organisation control the destination domain, or does it rely on a third-party platform domain? Ownership provides control; third-party domains introduce dependency.
• Redirect transparency. For dynamic codes, can you trace the full redirect path from scan to landing page, and are all intermediate domains under your control or a contracted provider you have vetted?
• Access controls. Who can change the destination URL for a dynamic code? Is multi-factor authentication required? Are changes logged?
• Preview behaviour. What does the user see before the destination loads? Some scanning apps preview the URL; others open it immediately. The organisation cannot control which app a visitor uses, but it can choose destination URLs that are clearly identifiable when previewed.
• Physical security. Is the code placed where it can be easily covered or replaced? Is the surface smooth enough that a sticker would be noticeable if removed? Is the code large enough and high-contrast enough that a low-quality overlay would be visually obvious?
• Decommissioning plan. When the campaign, exhibition or event ends, what happens to the codes? Are they removed, disabled or left active with no ongoing purpose?

QR code security in physical environments is not a matter of choosing a "secure" QR code product. It is a matter of controlling the destination, managing the redirect path, inspecting the physical installation and planning for the end of the code's useful life. The technology itself is neutral; the risks arise from how it is deployed and maintained.

Control redirect ownership and printed-code inspection

Dynamic redirects are useful only when the organisation controls the domain, account recovery and change log. Inspect public codes for overlays, monitor destination changes and preserve an emergency replacement route. Staff should know who can authorise a redirect and how to disable a compromised code without waiting for a new print run.