Two different security questions
Almost everything written about QR security answers the scanner's question: is this code safe to scan? That advice is sound and it is well covered by security vendors and universities.
This article answers the other one. You are a restaurant, a church, a parking operator, a retailer. You are printing codes and putting them where the public can reach them. Your risks are not the same, and neither are the countermeasures, because most of yours are physical and editorial rather than technical.
The short version: you cannot control what a scanner's phone does, but you can control how hard your code is to tamper with, how easy it is for a customer to tell yours from a fake, and how fast you can respond when something goes wrong.
The attack that should actually worry you
A sticker placed over your code. That is the whole attack, and it does not require any technical skill.
The FTC has documented reports of scammers covering up QR codes on parking meters with a QR code of their own. The customer scans what they believe is your code, lands on a page that imitates yours, and hands over card details. The business finds out when the chargebacks or the complaints arrive.
Nothing about the QR standard prevents this. A QR code is a printed pattern, and a printed pattern can be covered by another printed pattern. Error correction does not help, because the replacement code is a valid code. The generator you used does not matter, because your code was never involved.
That reframes the problem usefully. Your defences are: make substitution physically harder, make it detectable by the customer, and make your own response fast.
The adjacent tactic is unsolicited codes arriving by post or message. The FTC has a separate alert about QR codes on unexpected packages, where the code claims to reveal who sent a gift. That one is not your problem to solve, but it shapes how cautious your customers are by the time they reach your signage.
Print the destination next to the code
This is the highest-value thing on the page and it costs one line of type.
A customer cannot inspect a QR pattern. They can read text. If the sign says ez-qr.com/r/menu beside the code and the scan opens something else, a proportion of people will notice, and the ones who notice will tell you. A code with no readable destination gives nobody anything to check.
It works better when the printed URL is short and branded. A long tagged campaign URL is unreadable on a table tent and unverifiable in practice. A short branded path is both. That is a genuine security argument for dynamic codes rather than a commercial one, since the redirect is what makes the short readable form possible.
Add the organisation name near the code as well. "Menu — Riverside Cafe" plus a readable URL gives a customer two things to match against, which is two more than a bare square offers.
Tips
- Readable URL beside the code, always. Short enough to actually read at arm's length.
- Use the same domain across every placement so the pattern is familiar to repeat customers.
- Avoid third-party shortener domains on printed material. They are unverifiable and heavily used by attackers.
What never to put behind a scan
Never a login. Never a payment form. Never a request for personal details.
This is a policy decision rather than a technical one, and it is the single biggest contribution a business can make to the ecosystem it operates in. When a legitimate business puts a payment form behind a scanned code, it teaches its customers that this is normal, and that lesson is exactly what the attacker needs to have already been taught.
The FTC's advice to consumers now includes not scanning codes in unexpected places and inspecting the URL before opening it. Any flow you design that requires a customer to override that instinct is working against them.
Safe destinations behind a scan: menus, information pages, a link tree, an app store listing, a review page, a schedule, a document. Anything where the worst case of landing on the wrong page is wasted time rather than lost money.
If you genuinely need payment from a scan, send the customer to your own domain first and let them start the transaction from a page they arrived at knowingly. The extra tap is worth it.
Placement and inspection
Substitution is easiest where a code is unattended, reachable, and rarely looked at. That describes most outdoor signage.
Place codes behind glass, under laminate, or inside a frame where you can. A code that has to be prised out is a code most opportunists skip. Where the code has to be exposed, put it somewhere staff pass regularly rather than at the far end of a car park.
Build a check into an existing routine rather than creating a new one. Opening staff already walk the floor. Adding "scan the table tents" to that walk costs a minute and catches a sticker the same day it appears rather than the same month.
Tamper-evident placement helps: a code printed as part of a larger graphic, crossing a border or a photograph, is harder to cover cleanly than a code sitting alone in white space. An overlay sticker on a busy background is visible from several feet away.
For codes on products rather than signage, the packaging guide covers substrate and placement in more depth, including why seams and curves matter.
Tips
- Behind glass or laminate wherever the placement allows.
- Add a scan check to an existing opening or closing routine.
- Print the code as part of a larger graphic so an overlay sticker is visually obvious.
- Photograph each placement when installed, so staff have a reference for what correct looks like.
Dynamic codes as incident response
The security case for dynamic codes is response time, and it is stronger than the marketing case.
If your destination is compromised, or a campaign page is defaced, or you discover the link has been pointing somewhere wrong for a week, a dynamic code lets you repoint every printed instance from a dashboard. Signage stays up, the problem stops.
A static code cannot be fixed. The destination is encoded in the pattern, so the only remedy is physically removing or replacing every printed copy, which for a chain with signage across dozens of sites is a multi-week project during which the codes keep resolving to the wrong place.
Scan analytics help too, in a way that is easy to overlook. A sudden collapse in scans on a placement that was steady is a signal worth investigating, because a covered code stops registering scans on your side while continuing to collect them for someone else. That is often the first detectable symptom.
For multi-site operators, generate per-location codes with bulk import rather than sharing one code across every branch. One code per site means a compromised placement is isolated and identifiable rather than ambiguous.
Destination hygiene
The page behind the code is part of the code's security posture.
Serve it over HTTPS. A browser warning on arrival is exactly the signal that makes a cautious customer abandon, and it makes a legitimate destination indistinguishable from a suspicious one.
Keep the destination on a domain you control and that customers already associate with you. Routing a printed code through a domain nobody recognises removes the customer's ability to sanity-check the result, which is the whole point of printing the URL in the first place.
Make sure the destination stays alive. A code that resolves to a 404 is not dangerous, but it is corrosive: it teaches people that your codes do not work, and the next time one fails they will assume the same rather than reporting it. Our best practices guide covers the pre-publish checks.
If you route by device or region with a multi-destination code, test every branch. A rule that sends a minority of traffic somewhere stale is the kind of thing that goes unnoticed for months.
If you find a code has been tampered with
Work through this in order. The first two steps are about stopping harm; the rest are about evidence and prevention.
Tips
- Remove or cover the fraudulent code immediately, before anything else.
- Scan it once from a device you control to capture the destination, then do not interact with the page.
- If your own code was dynamic, repoint it so any remaining printed instances resolve somewhere safe.
- Photograph the placement as found, for the police report and for any card-scheme dispute that follows.
- Tell customers plainly through the channels you already use. Businesses that say nothing look complicit when it surfaces later.
- Report it. In the US that is the FTC at reportfraud.ftc.gov, plus local police for the physical tampering.
- Check every other placement that day, since sticker campaigns are rarely a single location.
- Review why it went unnoticed, and put the inspection into a routine that already happens.
What your customers are being told
It is worth knowing the advice the public is now receiving, because your codes have to survive it.
The FTC tells consumers to inspect the URL before opening it, to check for misspellings and switched letters in a domain that looks familiar, and not to scan codes that arrive by unexpected text or email. Universities and security vendors publish similar guidance, and it is spreading.
The implication for a business is not that QR codes are finished. It is that presentation has become a security control. A code with a readable branded URL, an organisation name, a sensible placement, and a destination that loads over HTTPS on a recognisable domain passes every one of those consumer checks. A bare square taped to a wall fails most of them, and increasingly gets treated the way it deserves.
Sectors where trust is already the product feel this first. A donation code or a restaurant menu that looks improvised costs scans in a way it did not three years ago. Presentation is now doing security work, and the businesses that treat it that way keep their scan rates.
