Catching a Hijacked Dynamic QR Code
A dynamic QR code points to a redirect you control, and the redirect's destination can change without the printed code changing. That is the feature — and the risk. If someone gains access to the redirect, or if a colleague edits it by mistake, every printed copy silently starts sending scanners somewhere new. The defence is a baseline: the destination the code is supposed to point to, recorded when the campaign goes live, and checked on a schedule.
How to use the baseline
When the campaign launches, paste the intended destination here and save it as the baseline. At each review — weekly for a live campaign, monthly for a long-lived one — paste the destination the code currently resolves to and compare. The detector breaks the difference down by scheme, host, path, and each query parameter, so a small edit does not hide inside a long URL.
Which change matters most
A host change is the hijack signal: the destination now belongs to a different site. A path change may be a legitimate page move or a swap to a lookalike page on the same host. A parameter change may be an added tracking ID or an added credential. Any unexplained change means the same thing operationally: pause, verify with the link owner, and do not reprint until the change is explained.
- Save the baseline at launch, not after the first review.
- Check on a schedule, not only when someone reports a problem.
- Record who changed the destination and why, alongside the baseline.
- If the host changed and nobody can explain it, treat it as an incident and report it.