DEV Community: Dan Foley

# Trustworthy QR Codes: A Field Guide

Dan Foley — Tue, 22 Sep 2026 14:12:39 +0000

Best Practices for Safe and Secure QR Codes

Scanning a QR code has quietly shifted from a novelty to a reflex action. You see them on menus, parking meters, receipts, table top placards, everywhere. If an organization wants to deliver digital information to a user in the physical world, they print a square of dots. And people scan without thinking.

For anyone who puts a QR code out in the world, a marketer, a restaurateur, an event organizer, this feels like magic: that printed square delivers users to a digital asset. For an attacker, it is an invitation to use your brand to scam users.

The QR code is fundamentally asymmetrical. Unlike a URL, a human can’t read the black-and-white grid and understand what it does or where it goes. Instead, they rely entirely on the visual context around it—your company's logo, your branded sign, your physical premises. The code borrows your brand equity to mask an arbitrary payload. So when a scammer slaps a vinyl sticker over your menu sticker, signage or parking meter, your print materials become a direct pathway for fraud.

Federal agencies and consumer regulators now issue regular alerts about "quishing" (QR phishing). Yet most warnings tell users to "be careful," offering zero practical guidance to the people actually printing the materials.

You cannot stop a bad actor from printing a sticker with a bogus QR. But you can design your collateral so tampering is immediately obvious, payloads are transparent, and scans are reliable across every phone camera.

Not only does this reduce your immediate exposure, these practices build trust over time. Taking ownership of your code’s behavior in the field is like ‘conversion insurance’. When people trust your codes, they scan them. When they get burned, they stop.

Below are practical guidelines for printing QRs that protect your users and your brand.

1. Make the Destination Obvious

When a phone camera recognizes a QR code, the OS displays a small preview bubble in the viewfinder. That preview is your first—and often only—line of defense. Give your users the context they need to verify what their screen is showing before they tap through.

Anchor on the destination. Never print a bare QR code by itself. If the code routes to a website, print the plain-text URL right beneath it (brand.com/menu). If it joins a guest network, print the network name (SSID). If it initiates a payment, print the exact recipient name or payment address. When the printed text matches the on-screen preview, users can spot a misdirection instantly.

Keep your web address short. The preview bubble in iOS and Android viewfinders fits roughly 30 to 35 characters before it truncates with an ellipsis (...). If your link is qr.brand.com/summer, the user sees your exact company name right up front. If you bake in deep directory structures or tracking subdomains (analytics.marketing-cloud.us-east.brand.com/...), your real domain gets cut off. The preview turns into an unreadable string that looks suspicious to smart users and provides zero validation to everyone else.

A shorter link makes a better print. Bloated links produce dense QRs - more of those grids made of tiny squares (modules). On cheap paper or rough cardstock, those tiny dots bleed together in the ink. In dim restaurant lighting or through a scratched phone lens, dense codes fail to scan. Shorter links keep the grid sparse, sharp, and easy for any camera to read from a distance.

2. Own the Plumbing

Physical print can outlast your digital campaigns. A poster hung in an office lobby or an outdoor kiosk can sit untouched for months. Depending on who generates your codes and how they point to a destination, your print run can become a liability over time.

Anchor every code to your own domain. If your QR encodes a URL, keep the user inside your brand’s namespace from the very first hop. The viewfinder preview only displays the first hop of the URL, not where your server eventually routes them. Routing users through a generic URL shortener or a third party platform throws away the only visual verification cue your user has before they tap. Building around your own domain maintains a clear line of custody between the physical sign and what the user sees on the screen.

Point to a router, never the endpoint. Physical inks outlive marketing sprints. If you print a direct link to a temporary landing page, that code dies the moment the campaign ends. Old collateral ends up pointing to dead 404s or abandoned directories, which confuses users and opens the door to domain-hijacking attacks. Always direct your QR to a permanent, internal redirect relay: a lightweight routing rule on your server that recognizes the path and forwards the user to the correct downstream resource. This cleanly separates the ink on the poster from the destination on your server. You can swap targets, update seasonal menus, and gracefully sunset expired promos without having to send a crew out to scrape off old signs. And it gives you a friction-free mechanism to collect usage analytics and campaign performance.

(Note: This is what vendors sell as "Dynamic QRs," which is mostly marketing fiction. The printed matrix is completely static; it simply holds a fixed string conforming to standard specifications. The "dynamism" is standard Layer-7 plumbing: an HTTP redirect on a web server pointing to a new destination. You do not need an expensive subscription service for this; a lightweight redirect rule on your own domain handles it cleanly.)

Avoid third-party link shorteners. Public shortening services (bit.ly, tinyurl) save space, but they obscure your identity. Worse, you lose operational control. If a third-party platform flags your account, alters its routing logic, or suffers downtime, your physical signage goes dark with it. Keep all routing inside your own branded infrastructure.

Never use "free dynamic QR" or similarly marketed generators. Services found via quick web searches often run a bait-and-switch. They route your code through their intermediary domains for free until the collateral is already in the field, then deactivate the link or hold the destination hostage behind a recurring monthly fee. Generate your codes in-house using command-line utilities, open-source libraries, or native design tools, pointed exclusively to domains you own.

Plan for retired campaigns. When an initiative wraps, never dump traffic onto a generic homepage or leave behind a dead 404. Update the server relay to serve a deliberate landing page: "This promotion has closed, but here is what is happening now." If an unmanaged domain behind an obsolete print run lapses entirely, an attacker can register it and serve malware directly from your legacy collateral.

3. Make Physical Tampering Obvious

Most real-world QR attacks rely on the simplest exploit imaginable: placing a sticker directly over your printed code. Design your materials so an overlay looks glaringly out of place.

Print the code directly on the stock. Never use QR stickers on your own materials. Print the matrix directly onto the metal, acrylic, cardstock, or signage. If an attacker puts a sticker over a directly printed surface, the physical difference is easy to see and feel.

Add your logo to the QR. Adding your logo doesn’t prevent a spoofed sticker, but it links the QR to your brand and reassures the user. It also makes it harder for the scammer to scale their attack, meaning if a user expects a brand in the QR, the scammer can’t use a generic QR without a logo. Bump the Error Correction Level to Q or H, then overlay your logo in the center. The higher ECC lets the code still scan even though the logo covers part of it.

Recess the print behind protection. Mount sensitive public-facing codes like payment instructions or ticketing systems behind a layer of clear, anti-glare plastic, or use recessed frames for the QR. A raised sticker applied over a recessed surface creates an obvious edge that can be seen and felt.

Avoid high-gloss surfaces. While laminates protect paper from weathering, high-gloss plastic and polished acrylic reflect bright sunlight and overhead fixtures. Glare washes out the camera sensor, forcing the user to lean in, tilt their device, or give up entirely. Use matte finishes on all outdoor and public signage.

Audit in the field. If you run a physical venue where your codes are presented, train your staff to visually inspect them and run a finger over them on a regular basis. A rogue vinyl sticker has a physical ridge that a human finger easily detects.

4. Set Clear Security Boundaries

A standalone code asking someone to "Scan Me" is the physical equivalent of an unsolicited email attachment. Tell people precisely what the code will do, and explicitly state what it will never do.

Use action-specific instructions. Replace vague "Scan Here" copy with explicit promises: "Scan to open our lunch menu" or "Scan to view parking rates." Context helps users notice if the resulting screen asks for something different.

State your boundaries directly. If your code is in a high-trust or financial environment, tell users what is out of bounds. Print it plainly:

"Our menu code only displays food items. Staff will never ask for payment details through this code."
"This parking sign links only to our app. We never collect credit card numbers via web forms."
"This code connects you to guest Wi-Fi. We never ask for personal data or an app download to join."

When an attacker slaps a malicious payment sticker over a sign that clearly states "We never ask for payment details," the scam falls apart.

Keep analytics off the physical code. Do not bloat your printed URL with dozens of tracking parameters, campaign tags, and referral strings. Encode a clean, simple link into the QR code, and let your web server append campaign variables and tracking cookies downstream after the user arrives, as described above in the ‘Point to a router…’ section.

Deliver lightweight mobile pages. When a user scans a physical code, they are balancing groceries, waiting in line, or otherwise distracted. Honor their intent immediately. Don’t redirect them to desktop layouts, heavy PDFs that require downloading, or interstitial splash screens. Your page should load in seconds over an ordinary cellular connection.

5. Production Specifications

A few non-negotiable print standards to keep in mind before sending collateral to the press:

Honor the Quiet Zone. A QR code requires an unbroken margin of empty space—at least four modules wide—around all four edges. Designers often crop too close to the matrix or crowd it with borders and text. Without this margin, camera software may struggle locating the corners of the code.

Maintain dark-on-light contrast. While modern high-end phones can occasionally read light codes on dark backgrounds, many budget sensors fail entirely. Avoid inverted colors, pastel shades, and brand-color palettes for the dots. Always stick to high-contrast dark modules on a clean, light background, even if your designers suggest otherwise.

Use the 10:1 distance ratio. Think about where your scanner will stand when they scan, and size appropriately. A menu on a table can be one inch wide; a billboard or subway sign scanned from ten feet away needs to be at least one foot wide. If a user has to stretch, lean over a railing, or squint through their camera to frame the code, the sizing is wrong.

Run proofs on actual stock, not a monitor. A backlit computer display does not represent ink on paper. Screen pixels do not reflect ambient light, wash out under fluorescent tubes, or absorb ink. Always print a physical 1:1 proof on the final paper or plastic substrate. Even better, take it to the actual installation site, and scan it with both an iPhone and an entry-level Android phone under real-world lighting. And if you add your logo, test scanability with Error Correction bumped to Q/H.

The Pre-Print Checklist

Before any QR code goes to print, run it against this list to make sure you are maximizing the trust factor.

Destination clarity

Print the plain-text destination beneath the code (URL / network name / payee)
Keep the link short, with your brand name first so the ~30-char camera preview shows it

Use your own plumbing

Point to a domain you own — no third-party shortener (bit.ly, tinyurl)
Encode a permanent redirect relay, not a one-off campaign URL
Generate in-house (not a "free dynamic QR" site that can hold it hostage)
Have a plan for when the campaign ends (a deliberate landing page, never a dead 404)

Tamper resistance

Print codes directly on your material, not applied as a peel-off sticker
Place your logo inside the QR, making it harder to spoof
Display materials behind a fixed surface so an overlay is obvious
Select matte finish materials, reducing glare
Train staff to inspect public codes regularly

Establish clear boundaries

Describe with action-specific copy ("Scan to view the menu"), not vague "Scan Me"
State what the code will never do ("We never ask for payment here")
Use clean URLs, add tracking params server-side, not baked into the code

Production specs

Quiet zone: at least 4 modules of clear margin on all sides
High contrast: dark modules on a light background
Sized to the 10:1 distance ratio for where it will be scanned
Proofed on the actual stock and scanned on both an iPhone and a budget Android on-site, with Error Correction bumped to Q/H

A QR code is like a trust fall: your users are assuming your brand represents a safe and compelling transaction. When you print your codes, you’re asking prospects to expose their phone to your digital domain, so do everything you can to ensure they are satisfied.

If you make your codes simple to read, easy to verify, and hard to modify, you strip away the camouflage scammers rely on. You protect your brand's integrity—and you make sure your print collateral actually does the job you designed it to do.

India Skipped the Credit Card. Now It's Paying for It.

Dan Foley — Tue, 01 Sep 2026 09:52:09 +0000

A handy new technology spreads halfway around the world before security gets its shoes on.
— a riff on the famous old saying about a lie and the truth; it seems even more fitting today.

For the last few months, my security alert feed has been filled with India. Not by design (I follow QR fraud globally), but the coverage keeps arriving from Indian outlets, faster and more voluminous than from anywhere else. Fake refund codes. Poisoned parking stickers, KYC updates needed, and more. Each piece outlines a particular scam, replays warnings from CERT-In, India's national cyber agency, and closes with advice that conveys little more than 'be careful'.

The lazy read is that India is more careless than everyone else. It isn't. Something structural is going on, and it's more interesting, and more universal, than a story about one country's explosive growth of scams.

India Didn't Fall Behind. It Jumped a Generation

Most of the world crept into digital payments. India vaulted.

Financial institutions in the West spent fifty years laying down plastic: credit cards to imprint, then with magnetic stripes, ultimately embedded chips. Behind the convenient plastic card in the user's hand was a vast network of point-of-sale terminals, merchant onboarding services, transaction incentives, and network providers.

India never fully adopted any of it. Card penetration and terminal coverage stayed thin. So when digital payments arrived, India didn't need to retrofit the old rails. It skipped them entirely and built UPI, the Unified Payments Interface, launched by a national body (NPCI) in 2016. Real-time. Account-to-account. Free at the point of use. A customer pays by scanning a QR code. No card reader, no terminal, no special hardware at all. A printed square taped to a counter turns a fruit cart into a merchant.

This remains a genuine triumph. UPI moves more real-time transactions than any system on Earth, by a wide margin. It is, by most measures, the most advanced consumer payment rail humanity has built. Designed by Indian engineers, endorsed by the Indian government, and supported across Indian institutions.

When people talk about "technology leapfrogging", Scandinavia skipping copper wire and going direct to mobile services has been the canonical example. India's jump to UPI belongs in that category, and maybe not as the second example.

Yet every leapfrog carries a hidden cost, and it's the same cost every time.

Leapfrogging skips the immune system

When you jump a technological generation, you don't just skip the plumbing. You skip the immune system that co-evolved with the thing you jumped over.

The West's card economy dragged a half-century of defenses behind it, most of them invisible until they fire: chargebacks, dispute resolution, issuer fraud-scoring, liability shift, terminal vetting, the whole apparatus that quietly identifies fraudulent transactions and stops them. Nobody experiences that scaffolding directly; it doesn't introduce any friction in the transaction. You notice it only on the rare occasion that something gets flagged. And if you dispute it, the provider shifts the cost from you. The benefit of this immune system is not just the infrastructure built around transaction integrity, it's also the business model designed to absorb a certain amount of fraud. Credit card users benefit from both convenience and peace of mind.

India inherited none of it. Not because it was reckless, but because India never adopted the cards that the immune system was built around. You can leap to the destination. You cannot leap to the antibodies. They only come from having lived through the disease and building defenses bit by bit.

If that sounds like a metaphor doing too much work, consider that we have already run this exact experiment once, with the last technology the world leapfrogged into.

We have seen this movie before. It was called wireless.

The first automatic mobile networks, Nordic NMT, launched 1981. Automatic, in this case meaning no human operator was involved, the network was connected across international carrier networks, and rather than a single radio tower covering a single geography, a grid of smaller, geographically distributed radios each allowing frequency re-use within its area of coverage. A communications miracle that wasn't constrained by existing infrastructure that needed repurposing. This approach was clearly superior to others. The cellular game was on.

Since this analog 'cellular network' model was built from a clean sheet, they didn't carry forward any of the antibodies previous network operators had developed. They shipped with essentially no authentication and no encryption. A phone announced its identity over the air in the clear, and anyone with the right radio gear could capture that identity and clone the handset, charging their calls to a stranger.

This was not a fringe problem. At its peak, cloning fraud cost U.S. analog carriers more than $500 million a year. The convenience had spread halfway around the world; the security was still lacing its shoes.

The fix was not a patch. It was a new generation of hardware, protocol, and handset. By the early 90s, carriers knew they needed to move to digital (marketed as 'second generation,' or 2G). The GSM standard introduced the SIM card, a tamper-resistant chip holding a secret key, running a cryptographic challenge-and-response so the network could verify a phone was really itself. Authentication, the immune system that analog never had, was retrofitted after the fraud, in response to it.

That is the pattern, stripped to its bones: convenience ships first, fraud fills available capacity, and the defensive layer gets built afterward. At a cost and in a hurry.

India's QR fraud is not a new story. It is the same movie playing out in a new medium: payments instead of phone calls, a printed square with black dots instead of an unencrypted radio signal.

Except the QR turns out to be an even better weapon for scammers.

Why the QR rail turbocharges fraud

Three features of the way India pays turn "no immune system yet" into "epicenter." Each is a major boon for digital payments, but each presents vulnerability in the immune system.

First, UPI is a push, not a pull. A credit card payment is a pull: the merchant requests money from the card issuer after the transaction, and the whole disputable, reversible card machinery sits between the request and your money.

UPI is a push: you authorize money out, and it is gone. Instant, irreversible, into a real bank account, with no chargeback to claw it back. It's akin to a debit transaction rather than a credit one, but without the physical card or the point-of-sale terminal; you approve the push right on your phone. That single design choice moves the entire attack surface. Card fraud is a data problem: steal the number, try to use the card. UPI fraud is a consent problem: convince a human that the transaction is normal and as-expected. The attacker's job is no longer technical. It's persuasion.

Second, the trust surface is paper. There's no terminal to vet, no card skimmer to check for, no hardware to compromise, just a sticker with some dots. Anyone can print one, and the way they work, that printed sticker can instruct the phone to connect to anywhere. My sticker can be pasted over your sticker, and I've redirected the transaction to my bank account. In a shop or restaurant, on a parking meter, anywhere. A clean reprint is indistinguishable from the original; humans can't parse the dots the way the phone can. The thing standing between a payment and a fraudster is an adhesive rectangle.

Third, the QR hides the 'direction of travel'. A QR collapses "who am I paying, and which way is the money going" into an opaque square the eye cannot read. That's why the single most common Indian con is "scan this to receive your refund." It works because most people don't know the one rule that would save them. As Indian outlets themselves now state plainly, you never need a UPI PIN or an OTP to receive money, only to send it. The victim thinks they're accepting cash. They're actually authorizing its exit. The square never showed them the arrow.

In addition, an accelerant. In 2016, the same year UPI launched, India's disruptive newcomer MNO, Reliance Jio, collapsed the price of mobile data to among the cheapest in the world, putting a smartphone into hundreds of millions of first-time hands. India didn't onboard a generation to digital payments gradually. It onboarded them all at once, like a Cambrian Explosion, and faster than the security antibodies could imprint. The convenience arrived instantly. The security immune system is still developing.

This isn't about India getting it wrong

India is going through a natural evolutionary cycle, and doing it pretty well.

India is not unique, but it is the clearest, best-documented case of a universal pattern. UPI provides the biggest, most transparent instance, which is why it dominates my alerts. Wherever push-payments and QR codes leapfrog the old rails, the same frontier opens: Brazil with PIX, Southeast Asia with QRIS and PromptPay, Kenya with M-Pesa. And, one generation back, everyone using analog wireless. This pattern generalizes across space (from India to Brazil) and across time (from cloned phones to poisoned payment codes). It is not an emerging-markets quirk. It is simply what technological leapfrogs do.

And India is institutionalizing its immunity development. Regular notifications and warnings from CERT-In; the RBI acts; NPCI moving to rein in the collect-request feature the scammers abused. The immune system is mobilizing; it's simply behind the adoption curve, which is exactly what "leapfrogging skips the immune system" predicts. A rate mismatch, not a social failing.

Rebuilding the antibodies

The useful thing about an immune system framing is that antibodies can be built deliberately, but that doesn't mean you have to catch every disease first. Some defenses are concrete and available to you today.

If you accept payments by QR, the most important move is to own the destination: point your QR at a domain you control, not a third-party redirect. These 'dynamic QR providers' can change terms of service under you or hold your printed codes hostage behind a subscription fee.

Make your domain simple and legible, then print it in plain text right next to your QR code. This lets the user match their phone preview with your destination.

But that isn't an airtight approach. A QR that can be covered by a sticker will be, so place the QR where tampering shows and tell users to never trust a sticker overlay. That guidance does a couple of things: it puts you in a better position of control and trustworthiness, and it helps users build up their own antibodies by reading and checking before the scan.

For the person holding the phone, your immunities will build up over time, but almost all of what you need to do collapses into two habits.

First, the one rule that defuses the most common con outright, and in India's UPI system it's ironclad: you never need to enter a PIN or an OTP to receive money, only to send it. Anything that asks you to "scan and approve" to collect a refund is probably taking your money, not giving it.

Second, know where the QR goes before you act on it. Look at the real URL destination, review the payee and amount. The square shows you none of that by design; a pre-scan step that reads it out before your phone acts is the point-of-scan antibody the old institutions used to provide for you. Today, institutions don't do that, but there are apps available in both app stores that you can use to pre-scan and safety score QRs. That's the immune system building up, in your hand.

The square you cannot read

Step back far enough and the QR code is a single, radical idea: a trust-compression device. It takes everything you'd want to know before parting with money or attention (who is on the other end, where this leads, which direction the value flows) and compresses it into a pattern of squares that no human can decode by looking.

For most of economic history, that trust lived in institutions you could see: a bank branch with a name over the door, a card network's logo, a payment terminal a merchant had to be vetted to own. The QR economy strips the institution out of the middle and puts the transaction directly between two phones. That's the source of its magic (a fruit cart becomes a merchant with a fifty-cent sticker) and the source of its danger. Because when you remove the institution, you remove the place the immune system used to live. The defensive layer has to be rebuilt somewhere new: not in a bank's back office, but at the point of scan, in the individual's hand.

That is not an Indian problem. It's the frontier every QR-native economy is walking toward, whether it's noticed yet or not. India just got there first, the way pioneers always reach the frontier first, and meet its hazards first, and end up writing the field guide the rest of the world will read.

The scams filling my newsfeed aren't evidence that India got it wrong. They're evidence that India got it early. India succeeded at convenience so completely, and so fast, that it arrived at the place the rest of us are still heading, the place where the technology has spread halfway around the world and security is only now reaching for its shoes.

It's a postcard from the future. Worth reading closely, because the return address is us.

Sources & further reading: Ericsson — the launch of NMT · Analog cellular "cloning" fraud · CERT-In / India QR-fraud coverage.