QR Phishing Is No Longer a Niche Risk

A QR code is a link with the address hidden until a device reads it. That makes it useful for menus, packaging, event signs, and invoices, but it also makes the final destination easier to obscure.

APWG's Q1 2025 summary warns that criminals are sending large volumes of QR-code emails that lead to phishing sites and malware. The safer habit is to preview or extract the destination before acting.

Dynamic QR platforms let marketers change the destination after a code is printed or sent. That is convenient, but it also means a customer cannot know from the printed code alone whether the destination will stay stable.

Businesses should keep a record of expected destinations, avoid unnecessary shorteners, and use an official domain whenever a QR code leads to login, account, or customer-action pages.

Tracking links help analytics teams understand campaign performance. They also create extra redirects that customers may not recognize.

If a QR campaign uses redirects, the landing page should be clearly branded, mobile-friendly, and easy to verify. Customer support should know what links are official.

Use the QR Link Checker to extract a QR destination locally when your browser supports it. Use QR Campaign Preflight before printing or sending a campaign. For customer-facing campaigns, request review when links are sensitive or widely distributed.