QR Code Security — How to Protect Yourself from Fraud

QR codes are everywhere — on menus, posters, business cards, and packaging. But with increasing adoption comes increasing risk of fraud. In this article, you'll learn what to watch out for.

How QR Code Fraud Works

Scammers use QR codes in various ways:

Overlay attacks: A fake QR code is placed over a real one (e.g., on parking meters or in restaurants)
Phishing: The QR code redirects to a fake website that looks like a well-known page
Malware: The link leads to a malware download
Payment fraud: The QR code redirects to a payment page with the scammer's account

How to Protect Yourself as a Scanner

Check the URL: Your smartphone shows the URL before you open it. Verify that the domain looks trustworthy.
No sensitive data: Never enter passwords or credit card details through a QR code link.
Spot overlays: Check if a QR code has been stuck over another one — that's a red flag.
Consider context: A QR code on a professional business card is more trustworthy than one on a lamp post.

How to Protect Yourself as a Creator

Use dynamic QR codes: If your QR code is misused, you can change the target URL immediately.
Use your own domain: qr.yourcompany.com looks more trustworthy than a generic domain.
Enable tracking: Monitor scan activity. Unusual patterns (sudden spikes, scans from foreign countries) may indicate abuse.
PIN protection: For confidential documents, you can set a PIN.
URL monitoring: qr9 automatically checks if your target URLs are still reachable and safe.

What qr9 Does for Your Security

Safe Browsing Check: URLs are checked against the Google Safe Browsing database when created
Scan monitoring: Automatic notification for unusual activity
Origin analysis: Warning when scans suddenly come from new countries
URL monitoring: Daily check if target URLs are still reachable
Swiss hosting: All data stays in Switzerland

Conclusion