Are QR codes safe to scan?

"Quishing" (QR phishing) usually works by physically covering a real, trusted QR code with a sticker carrying a malicious one — on a parking meter, a restaurant table, a delivery locker, a poster. The victim trusts the context (a parking meter looks official) more than the specific code, and scans without checking.

This attack targets static codes especially, since there's no way for the business to notice a sticker swap remotely. A business using a dynamic code at least retains the ability to see scan volume drop off oddly if a placement is tampered with, though it still can't detect the sticker itself.

Any short link, whether from a QR redirect service or a plain URL shortener, hides the actual destination domain until you click through. This is normal and not inherently malicious, but it does mean scanners can't tell where a code leads just by looking at the preview their phone shows.

The honest trade-off: this is exactly how every dynamic QR code works, including the ones 123QR generates. A short link is what makes the destination editable. The mitigation isn't avoiding short links altogether, it's only scanning codes from sources you trust the physical placement of.

A QR code advertised as connecting to WiFi could instead point to a fake captive portal designed to harvest credentials, or connect you to a network controlled by someone else entirely. Cafes, airports and hotels are common targets because people expect to see a WiFi QR code there and don't scrutinise it.

There's no reliable way to visually distinguish a genuine WiFi QR code from a malicious one before scanning. Ask staff to confirm the network name matches what the code connects to, and be more cautious of a WiFi code that isn't posted somewhere staff-controlled (e.g. taped loosely near a table rather than printed on the venue's own signage).

Every 123QR code redirects through a visible 123qr.net short link — we don't disguise or cloak the intermediate domain. A scanner's phone will show 123qr.net in the preview before the final destination loads, which is more transparent than services that route through unbranded or rotating domains.

We can't prevent someone from printing a malicious sticker over your legitimate code in the physical world, and no QR provider can. What we can do is give you scan analytics so an unusual pattern at one location is visible to you, and keep the redirect layer itself straightforward rather than obscured.