Skip to content
QR Code Tools logo
QR Code Tools
Sign in
Security Tool

QR Clone Risk Scorer

Score how easily a printed code could be cloned or overlaid, from placement, physical protection, code type, monitoring, and footfall exposure — with mitigations aimed at your biggest risk factors. The score is computed from your answers on a fixed points scale.

1. Describe the deployment

Method: points per factor are summed and clamped to 0–100. Bands: Low < 30, Medium 30–59, High 60–79, Critical ≥ 80. Footfall contributes up to 20 points, scaled linearly from the slider.

Result
Clone risk score
100 / 100
Critical risk
Placement+25
Physical protection+30
Code type+20
Monitoring+25
Footfall exposure+10

Mitigations

  • Use tamper-evident seals or destructible stock so an overlay is visible.
  • Use a dynamic code so a hijacked destination can be corrected without reprinting.
  • Check the destination on a schedule — or automatically — and compare it with the intended URL.

The Cheapest Attack Needs Only a Sticker

Cloning a QR code requires no technical skill: print a code that points somewhere malicious, stick it over the real one, and wait. Payment codes, parking codes, and donation codes are the classic targets, because the victim's money or credentials flow straight to the attacker. The defences are physical and procedural — make overlays visible, check the code itself, and watch the destination — because there is no way to make a printed pattern uncopyable.

Inspect the code, not just the destination

A destination monitor catches a hijacked dynamic link, but it cannot see a sticker over a static code. For unsupervised placements, schedule physical inspections: look for edges, extra thickness, or a code that does not sit quite square on its backing.

Frequently Asked Questions

What is QR cloning / overlay?

An attacker prints their own QR code — pointing at a phishing page or a payment account they control — and sticks it over yours. Scanners then reach the attacker instead of you. It needs no hacking, just a printer and a sticker.

Is this score a measured probability?

No. It is a risk score computed from the factors you enter, on a fixed points scale (0–100). It ranks deployments and shows which controls matter most — it does not predict that an attack will or will not happen.

Why does a dynamic code score better?

Because if the destination is hijacked or the code is cloned, a dynamic code lets you change the destination or disable the link without reprinting. A static code can only be fixed by replacing every printed copy.

What is the single most effective mitigation?

Physical: make overlays visible — tamper-evident seals, destructible stock, or mounting behind glass. Digital: monitor the destination so a change is caught in hours, not months.