How to Spot a Malicious QR Code: Scanning with Confidence in a Digital World

To fully grasp the security implications of scanning a QR code, it is necessary to understand the distinct operational differences between static and dynamic architectures. While both variants appear identical to the naked eye, their underlying data structures and functional capabilities differ drastically.

Static QR codes permanently embed the target information directly into the visual pattern of the matrix. A static QR code is a “one-trick pony”: once created, the information is set in stone and cannot be edited. The primary advantage of this architecture is its permanence and offline capability, making it suitable for transmitting plain text or local Wi-Fi credentials purely offline.

Dynamic QR codes resolve these limitations and represent the standard for modern business applications. Rather than encoding the final destination data directly into the matrix, a dynamic QR code encodes a short, unique redirection URL that points to an online resource. When a smartphone scans the code, the device accesses this short link, which routes the connection through a centralized server managed by the QR code platform. The server subsequently executes an automatic HTTP redirect, seamlessly forwarding the scanner to the intended final destination.

For years, the foundational advice provided by cybersecurity professionals for mitigating QR code risks has been to “always check the URL preview before tapping”. Modern smartphone camera applications facilitate this by displaying a small pop-up window containing the decoded URL, allowing the user to theoretically verify the destination.

The fundamental issue lies in the architecture of the dynamic redirect. When a user scans a dynamic QR code, the smartphone preview displays the intermediary short link, not the final destination website. If an organization utilizes a generic, free URL shortener or a low-tier QR code generator, the URL preview offers absolutely no contextual clues regarding the safety or legitimacy of the endpoint.

Threat actors actively exploit this opacity to execute quishing campaigns. Rather than encoding the phishing domain directly, an attacker encodes a link on a legitimate, trusted domain, such as an open redirect on a reputable website or a Google redirect URL. When the victim scans the code, the camera preview displays a familiar, secure-looking domain. Trusting the preview, the user opens the link, only to be forwarded through a chain of redirects to the phishing site^[4].

Since technical validation via URL previews is often obscured by dynamic redirection, the most effective defense against quishing relies on contextual analysis and physical inspection. Cybercriminals deploy malicious QR codes through various vectors, but these attacks consistently exhibit identifiable anomalies.

Because consumers cannot always verify the safety of a dynamic redirect, the responsibility for securing the ecosystem shifts to the organizations deploying the codes. A dynamic code's preview shows the platform's short link, not the final page, so scanners are trusting the platform. Choose a provider with a recognizable short domain and an acceptable-use policy that prohibits malicious destinations, and print your brand next to every code so scanners know who it belongs to.

Kebo QR's Terms of Service prohibit linking codes to malware, phishing sites, or scams, and reserve the right to disable codes that do. Beyond the rules, the dynamic architecture gives a business two controls a static code cannot:

• Edit or delete a code instantly

  If a destination is compromised, point the code somewhere safe or delete it from your dashboard, with no reprint needed. This protects codes you printed: a scammer's sticker placed over your code is a separate code, so inspect your signage regularly.
• Brand every code

  Add your logo and brand colors in Kebo QR, and print your business name beside the code. A plain black-and-white sticker stands out against a branded code, and your name tells scanners who the code belongs to.

QR codes represent a powerful, highly efficient technology that significantly enhances digital connectivity across the global economy. While the emergence of quishing and physical tampering highlights the ingenuity of cybercriminals, these threats should not precipitate a retreat from such a useful tool.

By maintaining situational awareness, inspecting public codes for physical alterations, and treating unsolicited codes with healthy skepticism, users can safely navigate the digital landscape. Businesses share the responsibility: print their brand beside every code, inspect public signage for stickers, and use a platform that lets them edit or delete a code the moment something looks wrong.