Skip to content
QR Code Tools logo
QR Code Tools
Sign in
Security Tool

QR Incident Report Builder

Record a malicious QR code properly: payload, location, timeline, behaviour, and evidence — then copy or download a structured incident report your security team can act on.

1. Enter the incident details

Result

0 of 3 key fields filled (payload, location, behaviour). Those three make the report actionable.

MALICIOUS QR CODE — INCIDENT REPORT

Reporter: (not given)
Date / time found: (not given)
Location found: (not given)
Context: Street poster

QR payload / destination:
(not given)

Observed behaviour:
(not given)

Device / OS:
(not given)

Actions taken:
(not given)

Evidence preserved:
(not given)

Handling notes: Do not rescan the code on a personal device. Keep the original photo and the payload above with this report. Share the report with the venue owner or the security team, and with the platform or registrar if the destination is still live.

Do not include passwords or full payment details in the report. Describe what was asked for, not the credentials themselves.

Reporting a Malicious QR Code Properly

A report that says 'there was a bad QR code' cannot be acted on. A useful report answers six questions: what the code contained, where it was, when it was found, what it did, what was done about it, and what evidence survives. This builder structures those answers so a security team, a venue owner, or a platform can act without coming back for the missing detail.

What to preserve before you report

Photograph the code in place before removing it — the photo proves the context and shows whether it was a sticker over a legitimate code. Save the decoded payload exactly as scanned, and screenshot the page it opened if it is safe to do so. Do not rescan the code on a personal device to gather more evidence, and do not enter any credentials on the page.

Who should receive the report

  • The venue or business owner, if the code was on their premises or packaging.
  • Your security team or IT helpdesk, if the code targeted staff or customers.
  • The platform hosting the destination, if it is a phishing page.
  • The domain registrar, if the domain is impersonating a brand.

If anyone entered credentials or payment details after scanning, treat that as a separate incident: change the affected password, review the account, and note it in the actions-taken section.

Frequently Asked Questions

Should I scan the code again to gather evidence?

No. Use the payload and photos you already have. Re-scanning risks triggering the malicious page again.

What if I do not know the payload?

Note that in the payload field and include the photo. A security team can decode the payload from the photo.

Do I need to include my password in the report?

Never. Describe what the page asked for, not the credentials themselves.

Is this report sent anywhere automatically?

No. It is generated in your browser. You choose who receives it by copying or downloading it.