QR code security: recognising quishing

Preview the destination and inspect the complete hostname. A familiar brand in the path or at the start of someone else’s domain is not sufficient. HTTPS protects the connection; it does not establish the operator’s trustworthiness. Approach unexpected login, payment or download requests through an independently known website or app.

Scanning, opening a page and entering a password are different steps. If you entered credentials on a suspicious page, change them through the real service and review active sessions. If you submitted payment details, contact the payment provider through its official channel.

Inspect displayed codes for replacement stickers and check their actual destinations regularly. Protect your QRinio account with a separate password and two-factor authentication. Give team members only the rights they need and revoke API keys no longer in use.

Do not publish credentials or confidential files on public contact, link or PDF pages. An obscure address is not access control. Use “Report content” for suspicious QRinio content and provide its exact URL and your reason.