Why inspecting a QR payload beats trusting the label next to it
A QR code is opaque by design: the pattern means nothing to the human eye, so people trust the sign, sticker, or message around it. Attackers exploit exactly that gap by placing a sticker with their own code over a legitimate one, or by sending a code in a message that promises something appealing. Inspecting the payload closes the gap. You learn what the code actually contains — a link, a Wi-Fi join, a contact, a payment request — before any app acts on it, and you can compare that reality against what you were told to expect.
Each payload type carries its own risks. A URL payload opens a page, and the page may ask for credentials or payment; the danger is not the code but the destination. A Wi-Fi payload joins a network silently, which is convenient in a cafe and risky on an unknown network, since traffic on an open network can be observed. A contact payload adds data to your address book — mostly harmless, but a crafted contact can carry a misleading name or a premium-rate number. A payment payload asks your wallet to send money that cannot be reversed. Knowing the type tells you which question to ask next.
For URL payloads, read the host from the right, because that is where the registrable domain lives. Everything left of it is a subdomain the owner controls, which is why familiar-brand-looking hosts such as login.example.com.attacker.com are attacker.com wearing a costume. Check the scheme: a page asking for a password over plain HTTP is a stop sign, not a quirk. Look for credentials embedded before an @ sign, for raw IP addresses standing in for domain names, and for punycode that renders a lookalike domain as a familiar brand. Query parameters deserve a glance too — tracking parameters are normal, but redirect parameters can bounce you onward to a different site.
If you publish QR codes, inspection is also your quality control. Decode your own printed codes before they ship, compare the decoded payload against the intended one character by character, and repeat the check after any system migration. A single transposed character in a printed URL sends every scanner to the wrong place, and a Wi-Fi payload with a stale password locks every guest out. Inspection takes seconds; reprinting a run of labels takes days.
Finally, keep perspective. Most QR codes are mundane: menus, tickets, forms, product pages. Inspection is not about suspicion of every code; it is about reserving trust for the codes that earn it. When a code arrives unexpectedly, promises urgency, or asks for credentials or money, inspect it, verify the sender through a separate channel, and walk away if the two stories do not match.