Which QR code provider is secure?

Our answer: A QR code provider is secure if it protects your account, does not give your printed addresses to anyone else, and protects scanners from fraudulent destinations. Same-QR covers all three levels, with one gap that we name openly below. Check all three with every provider, not just the password.

Level 1: your account

Whoever takes over your account can redirect any printed code, for example to a fake payment page. Look for a strong password, login with a second factor if the provider offers it, and own keys for programs instead of shared passwords. Programs should only work with keys that expire.

Level 2: your addresses

The address in the code is embedded in the print. If it is reassigned after deletion, your old stickers lead to the content of a stranger. Ask whether deleted addresses remain blocked. A history of each destination change is also helpful, so you can see who changed what and when.

Level 3: the people scanning

Fraudulent QR codes are becoming more common, often as stickers placed over a real code. A provider cannot prevent someone from pasting something over it. But it can prevent its service from being used for fraud: reject suspicious destinations, offer a reporting option, and block reported codes.

What you can do yourself

• Regularly check publicly attached codes for stickers placed over them.
• Write the short address in small print below the code so scanners can compare it.
• Give employees and programs their own logins instead of your password.
• After every change, check with your mobile phone where the code leads.
• Never ask for bank details on the destination page without making it clear who you are.

How scanners recognize a genuine code

The address displayed by the mobile phone before opening should match the business. A code leading to a third-party payment page is suspicious. Explain to your customers where your code hangs and what it looks like.

This is how Same-QR does it

• Passwords only as a strong hash, login also with Google and its second factor
• Keys for programs with a validity period of 30 to 365 days
• Never reassign short addresses of deleted codes, track destination history per code
• Naked IP addresses as destinations are rejected, report issues with codes and pages, blocked codes show a warning message
• Gap: no own two-factor login, those who want it log in with Google

Conclusion

Security with QR codes means: protect your account, never reassign addresses, report and stop fraud. Check all three levels and ensure control on-site yourself.

Frequently asked questions