See where a QR code really goes QRSHIELD

Why a QR code needs reading before it is followed

A QR code is text and nothing more. The danger is not in the square: it is that a person cannot read it before acting on it, so the usual check, looking at a link before clicking it, is impossible by design. Pointing a phone at one is a click made blind.

That is why the attack works so well in the physical world. A sticker over the code on a parking meter, a restaurant table, an EV charger or a package costs nothing, needs no compromise of anything, and cannot be spotted by looking at it. Codes in email ("quishing") work for a related reason: the link is inside an image, so the filters that read links in text see nothing to check.

What it flags

• Where it really goes, in full, including through a shortener's own text if the destination is carried in the URL. It never opens the link or contacts anything.
• A payload that is not a link at all. A QR code can carry Wi-Fi credentials that join your phone to a network, a contact card that writes itself into your address book, a calendar event, a phone number to dial, or an SMS pre-filled to a premium number. Most scanners act on these with one tap.
• Characters imitating other characters in the domain, the same problem HOMOGLYPH exists for, and worse here because you never see the string.
• The registered domain, separated from the subdomains in front of it, because the part that matters is at the end.

The habit that helps more than any tool

Where a code is printed on something physical, run a finger over it. A sticker applied over the original has an edge you can feel, and that single check catches the entire class of attack in car parks and on restaurant tables.

Where a code arrives by email or message, treat it as a link you cannot see, which it is, and go to the site yourself from a bookmark instead. Nothing legitimate needs you to scan a code rather than type an address you already know.