How dangerous are manipulated QR codes?

How the attack works

A sticker over the real code – on the parking machine, on the charging station terminal, on a poster. The fake code redirects to a counterfeit payment page.

In an email, you see the suspicious address; with a QR code, you don't. This makes it attractive for attackers.

How to recognize manipulation

• A sticker adhering to something else
• A code that does not match the appearance of its surroundings
• An address after scanning that does not match the provider

The last point is the only reliable indicator.

What to tell your employees

1. Check the address before opening. All smartphones display it.
2. Be suspicious of payment requests. Never enter login or payment details via a scanned code.
3. Verify codes on invoices – counterfeit payment codes on real invoices are a known tactic.
4. Type the address manually if in doubt, instead of scanning.

What publishers can do

• Use your own domain for redirection. Then a foreign address is immediately recognizable.
• Include a short, descriptive address alongside, providing an alternative.
• Permanently attached codes instead of stickers where possible – engraving or printing directly on the object.
• Regular visual inspections for codes in public spaces.

The last point is almost never done and is most effective for machines.