1. Why It Slips Through
Text-based URL scanners may not inspect pixels. A QR code inside an image or PDF can hide the link, and the victim opens it on a personal phone outside corporate controls. Our [QR safety checker](/qr-safety-checker) guidance helps identify these threats.
2. Technical Controls
* Use email security that decodes QR codes in images and attachments and evaluates the target URL.
* Enforce phishing-resistant multi-factor authentication such as passkeys or hardware keys, so stolen passwords alone are not enough.
* Apply conditional access that checks device compliance for sign-ins.
* Provide managed mobile browsers or DNS protection on corporate devices.
* Train staff to use proper [QR scanner](/qr-scanner) apps that preview URLs before opening.
3. Process Controls
Require out-of-band verification for any QR request involving credentials or payments, and publish a simple reporting path. Legitimate business codes should be generated using trusted tools like our [URL QR code generator](/url-qr-code-generator) with proper tracking via our [UTM builder](/utm-builder).
4. Training
Run simulations that include QR lures and teach staff to read the destination domain before opening it. Use our [QR placement guide](/qr-placement-guide) principles to help staff recognize legitimate vs suspicious placements. Educate on using our [printed QR tester](/printed-qr-tester) methodology for verifying organizational codes.
Putting this into practice
Start with the smallest real test you can run. Generate the code, print it at the exact size you plan to use, and scan it with two different phones in the lighting where it will live. Check that the destination page loads quickly on a mobile connection and that the call to action next to the code tells people what they will get. If anything feels slow or unclear, fix it before you print a full batch, because reprints cost more than a short test. Keep a note of the size, material, and placement that worked so the next batch starts from a proven setup.
Common mistakes to avoid
The most common mistakes are easy to avoid once you know them. Long payloads make modules tiny, low contrast makes edges hard to read, and text placed too close to the border eats the quiet zone the scanner needs. Covering a corner finder pattern with a logo or a sticker breaks detection entirely, and a code placed behind glare or on a curved surface fails even when the print is perfect. Review each of these points on a proof copy, and treat any failure as a reason to adjust the design rather than a reason to blame the scanner.
Quick checklist
- Keep the payload as short as practical so modules stay large.
- Keep dark modules on a light background with strong contrast.
- Leave a clear quiet zone on all four sides of the symbol.
- Test the printed code at the real viewing distance and lighting.
- Confirm the destination page loads fast on a phone.
- Recheck the code after any change to the link, design, or placement.
