QR code phishing is on the rise. Here's the four-layer defense system we built directly into every scan β and why it matters for anyone putting a QR code in the real world.
The Problem With Dynamic QR Codes
Dynamic QR codes are one of the most useful tools in modern marketing: print once, update the destination anytime without reprinting. Change the URL for a new menu, a fresh promotion, or an updated event page β all from a single printed code.
But that same flexibility creates a security surface. A bad actor can create a dynamic QR code pointing at a legitimate destination to get it past initial checks, then redirect it to a phishing page hours later. The FBI has reported a sustained rise in "quishing" β QR-based phishing β where scammers swap legitimate QR codes in public spaces with their own, sending victims to credential-harvesting sites. The QR code looks exactly the same. Only the destination changes.
Most QR generators don't address this. They generate an image, hand you a file, and move on. We took a different approach: security controls built directly into the redirect path, not bolted on afterward.
Layer 1: Blocked Domain List
Before any QR code is created β or any destination URL is updated β we check the hostname against a maintained blocklist of known-malicious domains. If the domain is on the list, the QR cannot be created or updated. The check happens before the record is written to the database.
This is the fastest check: a single database lookup against a list our team maintains based on reported abuse. A domain that has been used in a phishing campaign gets added once and is blocked across every account on the platform forever after.
Layer 2: Google Safe Browsing β Every URL, Every Time
The blocklist only catches domains we already know about. For everything else, we query Google's Safe Browsing API β the same database that powers Chrome's phishing warnings β on every URL submission: at initial QR creation and on every subsequent destination update.
Safe Browsing checks for malware distribution, social engineering (phishing), unwanted software, and potentially harmful applications. If Google has flagged the URL, we block the creation or update immediately. The check runs in parallel with the domain blocklist, adding under a second of latency on average.
Critically, this check also runs when a dynamic QR code's destination is changed β not just at creation. That closes the bait-and-switch window: a QR code that started pointing at a legitimate URL cannot be silently redirected to a malicious one later.
Layer 3: Permanent Audit Log on Every Destination Change
Every time a dynamic QR code's destination URL is changed, we write a permanent record: the previous URL, the new URL, the timestamp, and the IP address of the account making the request. This log cannot be deleted by users.
This matters for accountability. If a QR code is ever involved in a reported incident, we can reconstruct exactly what destination it pointed at, when it changed, and where the change came from. For businesses, it's also a governance asset: a QR code you hand to customers is traceable, not a black box.
Layer 4: Rate Limiting on Redirects
The redirect endpoint β the path every scanner hits β is now rate-limited per IP address. Normal users scanning a code will never see this. But automated scripts probing scan analytics or running bot campaigns get cut off at 300 requests per minute per IP. The limit is generous for real usage and strict for automation.
What This Means in Practice
These four layers work as a defense-in-depth stack. No single check is foolproof β a brand-new phishing domain won't appear on any list for hours. But the combination of pre-creation scanning, a maintained blocklist, immutable audit logging, and redirect throttling raises the cost and complexity of misuse significantly.
Legitimate users don't notice any of this. Create a QR code, point it at your website, update it whenever your campaign changes, share it confidently. The checks happen in the background in milliseconds.
If something slips through, users can report a QR code through the platform. Reports go into a moderation queue and can trigger an immediate blocked status on the redirect β stopping all traffic to a flagged destination within seconds of a review.
The Foundation for What Comes Next
These four features are live now. On the roadmap: real-time URL reputation scoring, automated re-scanning of high-traffic QR codes at regular intervals, and webhook alerts when a code in your account receives a moderation flag.
Security in QR codes shouldn't be a premium tier β it should be infrastructure. We built these protections to be on by default, for every code, on every account.
