QR Codes the Hidden Risks: A Cybersecurity Perspective
The use of Quick Response (QR) codes became common during the pandemic as a fast, contactless method to connect physical items to online services. It has also become a means for one-to-one connections. It is used on business cards and in social media connections. However, this convenience comes with caution and risk. Now QR codes can be embedded with cyber malware. Corrupted QR codes are used to deliver phishing pages, steal payment data, or distribute malware. The consequences can be identity theft, financial loss, and device compromise.
Since QR codes are indecipherable, the result is that there is no way a user can tell one code from another. Essentially, the user must take it as a matter of faith that the code is legitimate. This is the advantage to the cybercriminal, since there is no way to tell one from another, attackers can easily embed malicious code into the printed or digital QR codes. Scammers will create advanced “split” or “nested” QR codes that bypass automated security scans. They can direct the user to fake sites, where financial transaction information can be harvested. As a new technology, people may instinctively trust QR codes placed in familiar or official-looking locations. However, the constant in cyberspace is to take nothing as a matter of faith.
As an example, in 2025, Barracuda Networks revealed that hackers launched a wave of “quishing” attacks targeting major organizations. These campaigns used split or nested QR codes embedded in phishing emails that bypassed corporate security filters. When employees scanned the QR codes with their phones, they were taken to counterfeit Microsoft 365 login pages, where attackers stole their credentials. Because the phishing links were hidden inside image-based QR codes, standard email scanners failed to detect them. Another attack using fake QR codes was used on parking meters. In this case, hackers placed fraudulent QR stickers over official parking payment codes. Drivers who scanned these fake stickers were directed to spoofed websites designed to harvest credit card details. Victims entered payment information, believing they were paying parking fees, but instead sent funds directly to cybercriminals. The scams not only cost users money but also created a public trust issue for city parking systems. For the third example, Ledger, a company that makes physical cryptocurrency wallets for individuals and businesses, reported a global phishing campaign targeting its customers. Hackers mailed professionally printed letters claiming to be from Ledger, warning of a “security breach.” Each letter included a QR code directing recipients to a fake Ledger website, where they were asked to enter their recovery seed phrases. Users who complied lost full access to their wallets, as the recovery phrase provides direct access to crypto assets. Ledger confirmed that the letters were counterfeit and reminded customers that it never requests recovery phrases.
What you can do, and how to avoid getting caught in these scams. Always verify the source of a QR code. Before scanning, make a physical inspection. Look closely for stickers or overlays that appear tampered with, especially in public places such as parking meters, restaurant tables, or flyers. Be skeptical of QR codes received via unsolicited emails, text messages, or physical mail. If there is an urgent request, if this is an immediate call for action to avoid financial catastrophe, take a long second look. For example, in the Ledger scam, users who ignored the unexpected letter avoided losing their funds because they recognized that the request was unusual. A general rule: if you didn’t expect it, don’t scan it.
Use a phone camera or a trusted QR-scanning app that shows the URL preview before opening the link. Check that the web address begins with https:// and that the domain name matches the legitimate source (for instance, “ledger.com” rather than “ledger-security-update.com”). In the parking-meter scams, victims could have avoided theft by manually entering the city’s official parking website instead of scanning the code. When in doubt, type the address manually into your browser or use a bookmarked link.
Never enter personal details, passwords, or financial information immediately after scanning a QR code unless you are 100% sure of the site’s legitimacy. QR codes can redirect to fake payment gateways or credential phishing forms. Likewise, avoid downloading apps or files directly from a QR code—always use official app stores. In the Barracuda “quishing” attacks, users who paused before logging in and verified the domain name avoided credential theft. Taking an extra moment to think before acting is your strongest defense.
For individuals, vigilance is key. In almost all scams, there is a crisis, there is an immediate call to action, and there is something that you need to do now. If this is the demand, you need to take a second look. Before scanning QR codes, first inspect the URLs, and always refuse to enter sensitive information on unfamiliar sites. Cybercrime is a multi-billion-dollar industry employing millions, and they are dedicated to stealing your money. Cybercrime is not a corporate issue; it is a personal responsibility issue. Staying vigilant and alert to the hidden dangers behind QR codes is only one more essential part of staying safe in a connected world.