To begin with, have no trust in anyone and presume that all QR codes are malicious.
You may have observed that we are now firmly in the QR code era, with QR codes prominently displayed in every restaurant, state office, and shop you visit. The technology is one of convenience, delivering the information we need quickly and directly but keeping the destination hidden until we reach it. That is to say, the ease of QR codes and URL shorteners comes at a cost in terms of security. How can you tell if a QR code or a short URL is safe to use?
The answer is, Nobody should be trusted.
To begin with, never make the mistake of assuming a short URL or QR code is legit. Always think it isn’t.
They’re simple to make, and a bad QR code can be applied to a legit QR code in a restaurant, for example. So, even if you believe you’re going to your favorite brewery’s beer list, you could end yourself on a phishing scam or another fake, harmful or dangerous website. Because it’s so easy to forge a QR code in public, you should believe they’re all fake.
Also, anyone can send you a short URL in an email, SMS, or other communication, and you may have no way of knowing if it is safe to use or not—so presume they are malicious as well.
Go, Manual :
When a company provides a short URL or QR code as a convenience, it is best to go straight to their website. Yes, this completely destroys the point of these tools, but it’s the only way to prevent your phone or another device from being hacked.
If the QR code or short URL is designed to lead you to a website that you can’t access using your browser, request a new menu or another document with the code or URL on it from the business. This reduces the chances that the code you’re about to scan is tampered with.
A scanner can help:
Adding extra security is another option. You can upgrade to a more secure QR code scanner that will check the URL you’re being taken to and give you the option to avoid it or continue. This feature is built into some phone operating systems’ stock QR code scanners, so you may already be protected.
You have a few alternatives for short URLs. If the URL was generated by Bitly, simply add a plus sign (“+”) to the end of the URL to get a preview. TinyURL, another popular URL shortener, has a preview capability as well—just type “preview” in front of the abbreviated URL. You can also use a site like Unshorten.it to see where the short URL will take you before you commit. It’s a reality of life that convenience frequently comes at the expense of security, and we live in a world where losing our phone is akin to leaving our house unlocked and the door wide open. When it comes to short URLs and QR codes, a few extra seconds of diligence can save you a lot of heartaches.
