QR codes in business
Also known as: QR code, QR codes, quishing, QR phishing
QR codes are scannable square barcodes that link physical items to digital content: menus, payments, sign-ups, Wi-Fi access.
They're cheap and convenient for businesses, but because people can't read a QR code's destination by eye, they're also used in scams ('quishing'), so both using and trusting them calls for care.
QR codes in business, explained at three levels
At home
A QR code is like a printed web address written in a pattern only cameras can read. The black and white squares encode text, usually a link, and your phone's camera decodes it in an instant. Businesses use them to send you to menus, payment pages or Wi-Fi settings. The catch is that you cannot see where one leads before scanning it.
At work
QR codes are square barcodes that store a link or other short data, read by any smartphone camera. Businesses put them on tables, packaging, posters and invoices to connect customers to menus, payments, reviews and sign-ups at almost no cost. Businesses also care about the security side, because scammers use fake codes, a trick called quishing, to send people to fraudulent sites.
At home
A QR code has three large squares in its corners that tell the camera where the code is and how it is tilted. The smaller dots hold the data, plus extra error-correction data, which is why a scratched or partly covered code still scans. Codes come in two kinds. Static codes hold the link directly. Dynamic codes hold a short redirect link, so the business can change the destination later without reprinting.
At work
Businesses use QR codes for contactless menus, payments, event check-in, Wi-Fi access and marketing. The risk comes from the hidden destination. Quishing attacks put malicious codes in emails, often posing as MFA setup or document notices, because email filters inspect text links more easily than images. Physical attacks place stickers over real codes on parking meters or menus, leading to fake payment pages. Staff training and checking your own posted codes address both threats.
At home
QR codes are just data, so they can do more than open a website: some add a Wi-Fi network, a contact or a calendar event. Phones show a preview of the link before opening it, which is the main defence, but scammers use look-alike domains and link shorteners to hide the real site. While QR codes are genuinely handy, in my view you should never enter a password or card number on a page reached by scanning a code you did not expect.
At work
From a security standpoint, a QR code is a link-delivery channel that sidesteps URL scanning and moves the victim from a protected work laptop to a less monitored personal phone. Defences include email security that decodes QR images, mobile threat protection on managed phones, phishing-resistant MFA so stolen passwords alone are useless, and awareness training. For your own codes, use dynamic codes on a domain you control, monitor where they redirect, and inspect public placements for tampering.
Real-world examples
At home
Aisha added QR codes to her shop's tables linking to a digital menu and loyalty sign-up: cheap, convenient, and popular with customers. Her MSP also warned her to periodically check that no one had stuck a fake QR code over hers, a known scam tactic.
At work
Marcus's staff received an email with a QR code claiming to be a required security update. Because their training covered 'quishing', they recognized that a QR code in an unexpected email was suspicious (it bypassed normal link scanning) and reported it instead of scanning, avoiding a phishing trap.
Common confusions
- QR codes are inherently safe to scan — A QR code just encodes a link you can't read by eye, and it could lead anywhere, including a scam site. Treat scanned destinations with the same caution as any link, checking the URL before acting.
- Scanning a QR code can't be part of a phishing attack — 'Quishing' uses QR codes to deliver phishing links, often bypassing email link filters. QR codes in unexpected emails or placed in public are a real and growing threat.
- A QR code on a business's own materials is always the real one — Scammers place fake QR stickers over legitimate ones (on parking meters, menus, posters). Businesses should check their codes for tampering, and customers should be cautious.
For analysts
QR codes are cheap and effective for linking customers to digital content, but they hide their destination, which scammers exploit ('quishing'). Protect your own codes from tampering, and train staff to treat a scanned link like any other: preview the URL and never enter credentials from an unexpected code.
History & origin
QR codes were invented in 1994 for tracking automotive parts and spread into marketing and logistics. Their use exploded when smartphone cameras began scanning them natively and, especially, during the pandemic, when contactless menus, payments, and check-ins made them ubiquitous. That very ubiquity attracted scammers, giving rise to 'quishing' (QR code phishing) and prompting security awareness around them.