QR codes are like Marmite.
Some people love them — scan to pay, scan to order food, scan to connect Wi-Fi. Others can’t stand them. But either way, they’re popping up everywhere.
And here’s the kicker:
Hackers love them too.
Because while you’re happily scanning away, you might be stepping right into their trap.
What Are QR Codes, Really?
A QR code is basically a fancy barcode. Instead of holding product prices like at the supermarket, it holds a link.
Scan it, and your phone does whatever that link says:
• Opens a website
• Downloads a file
• Adds a contact or Wi-Fi password
• Or, if you’re unlucky, something dodgier…
How Hackers Exploit QR Codes
- Fake posters & stickers
Hackers print dodgy QR codes and slap them over real ones in pubs, bus stops, or even parking machines. - Phishing links
A QR code can take you to a look-alike website designed to steal your login. - Instant downloads
Some codes can trigger downloads that install malware on your phone. - QR scams in emails
They’re harder for spam filters to detect, so scammers hide bad links in QR images instead of text.
Real Example
In 2022, US police warned drivers about QR codes stuck on parking meters.
The codes led to fake payment sites, tricking people into typing in their card details.
Simple, sneaky, and effective.
Do This Today
- Check before you scan
If the QR code looks like a sticker slapped on badly, don’t trust it. - Preview the link
Most phones let you see the link before opening it. If it looks weird, bail. - Don’t trust random codes in public
Only scan codes from trusted sources (restaurants, official websites, printed receipts). - Use your mobile data for payments
If a QR takes you to a payment site, switch off public Wi-Fi first. - Install a QR scanner app with security checks
Some apps can flag suspicious links before opening them.
Key Takeaway
QR codes are handy shortcuts — but shortcuts can sometimes lead straight off a cliff.
Treat them like any other link: with caution, not blind trust.
At The Cyber Workshop, our Phishing & Social Engineering Workshop digs into tricks like this and shows you how to spot them before you get stung. It’s not about paranoia — it’s about giving yourself that extra 10-second pause to stay safe.
Till next time,
If it looks like a dodgy sticker in a pub toilet — maybe don’t scan it.
