What is QR code phishing (quishing)?

Quishing is the practice of replacing or overlaying legitimate QR codes with ones that redirect to phishing sites, malware downloads, or fake login pages. Because most phones don't show a URL preview before redirecting, users are more vulnerable than with email links.

How attackers exploit QR codes

Physical overlay: A sticker placed over a legitimate code in a public place.
Destination hijack: An attacker compromises the account controlling a dynamic code and changes the destination.
Open redirect abuse: Using a trusted short domain with an arbitrary ?url= parameter to redirect to a malicious site.

Controls QRoute implements

Destination allowlist

QRoute only permits destinations using explicitly allowed URL schemes — primarily https://. The following are always blocked: javascript:, data:, credential-bearing URLs, private-network targets, and known phishing domains.

Tenant isolation

Every resolution checks that the incoming domain is owned by exactly one organisation and that the slug belongs to that same organisation. An unknown host or cross-tenant slug returns a generic 404 — no information leakage about whether the slug exists elsewhere.

Safe 404 for inactive codes

A paused, expired, or archived code returns a designed error page — not a redirect to any default destination. This prevents silent fallback attacks.

No open redirects

QRoute does not accept arbitrary ?url= or ?redirect= parameters. Only pre-validated stored destinations are ever used.

What you can do as an account holder

Enable two-factor authentication on your QRoute account.
Audit your API keys — rotate them regularly and scope them to minimum permissions.
Review the audit log for unexpected destination changes.
Set up webhook alerts for QR status changes.

Warning users before they scan

QRoute supports a configurable interstitial page for branded link destinations — a brief "you are leaving to X.com" warning that gives cautious users a moment to verify the destination before committing.