Cybersecurity & QR
QR sticker fraud in public places: protect your business and customers
A physical QR attack is simpler than it sounds: stick another code over yours. Customers scan “your” sticker and land on someone else’s site, checkout, or phishing form. It is one of the most common threats for cafés, parking, hotels, and outdoor ads.
What an overlay attack looks like
An attacker finds a popular QR (payment, menu, review, Wi-Fi) and pastes their own code of the same size on top. From a distance the swap is almost invisible. The phone camera reads the top layer — and opens the substituted content.
Sometimes the code is not fully covered: a cut-out window or a corner of a stand is enough. The goal is always to hijack the offline trust you already earned.
Where risk is highest
- Parking meters and payment terminals without constant supervision
- Café tables with a menu “on a sticker”
- Hotel desks, lobbies, elevators
- Outdoor ads, citylights, exhibition banners
- Donation boxes and charity QR codes
Business checklist
1. Regular inspections. Once a day (or after each shift) confirm the sticker is intact — no second layer, no different print.
2. Physical protection. Lamination, glass frames, or engraving on metal/acrylic make quick swaps harder.
3. Dynamic QR. If a code is compromised, you can change the destination in the cabinet without reprinting the whole batch — and send people to a safe warning page.
4. Scan analytics. A sudden spike from unusual countries or hours can signal a swap or mass copying.
5. Staff training. Servers and admins should know what the genuine code looks like and where it must lead.
What to tell customers
A short line on the table or receipt beats a long policy: “Check the URL before you pay” or “Use a protected scanner if you are unsure.” Give people a tool — not only a warning.
Point them to the QRcode Global scanner: it shows the code content and helps avoid opening a malicious link blindly.
Why dynamic codes beat static ones here
A static code permanently embeds the payload. If the sticker is swapped, you cannot “turn off” the old destination on your side — customers already scan someone else’s square. A dynamic code you control lets you change the target quickly, review stats, and understand the incident’s scale.