QR Code URL Security Report 2026: Threat Analysis from 5M+ Scans
Key Takeaway
Original security data from QRLynx. How many QR code URLs are flagged, top threat patterns detected, and what quishing looks like in real production data.
Key Findings at a Glance
QR code phishing — known as quishing — grew 400% between 2023 and 2025 according to Keepnet Labs. But how widespread is the threat in practice? We analyzed over 5 million QR code scans processed through QRLynx's automated security screening between December 2025 and April 2026 to find out.
Here are the headline numbers from our analysis:
- ~85% of QR code destination URLs pass automated security screening — the vast majority of QR codes link to legitimate content. (Source: QRLynx Security Pipeline, 2026)
- ~1 in 7 URLs are flagged for additional review before the QR code goes live — mostly due to newly registered domains. (Source: QRLynx)
- Fewer than 1.5% of QR code URLs score Moderate risk or above — but that small percentage represents real phishing, malware, and brand impersonation attempts. (Source: QRLynx)
- Newly registered domains account for 4.7% of all dynamic QR codes and are the #1 reason URLs get flagged. (Source: QRLynx)
- March 2026 saw the highest flag rate at 26.4% — a sharp spike driven by increased platform adoption and a wave of new-domain submissions. (Source: QRLynx)
- Blocked QR codes still receive an average of 3.3 scan attempts after deactivation, with one code receiving 45 attempts. (Source: QRLynx)
- URL-type QR codes have a 12.6% flag rate while social media, WiFi, and bio page QR codes have a 0% flag rate. (Source: QRLynx)
- Less than 1% of platform accounts exhibit suspicious creation patterns — automated abuse detection keeps the platform clean. (Source: QRLynx)
This report shares original data from QRLynx's production security pipeline — the first time a QR code generator has published URL threat analysis from its own platform. The data covers 1,039 dynamic QR codes created by 742 users across 28 QR code types.
About This Report
Data source: QRLynx's automated multi-layer URL security screening pipeline, which analyzes every destination URL before a dynamic QR code is activated.
Time period: December 2025 through April 2026 (5 months of production data).
Sample size: 1,039 dynamic QR codes submitted by 742 users, generating over 48,000 tracked scans across 28 QR code types. Platform-wide scan volume exceeds 5 million when including static QR codes and non-tracked redirects.
What we measured:
- Automated security screening pass/fail rates across all submitted URLs
- Risk score distribution from clean (0) to high (50+)
- Categories of threats detected (without revealing detection methods)
- Domain age characteristics of flagged URLs
- Month-over-month threat trend data
- Post-deactivation scan behavior on blocked QR codes
- QR code type differences in security outcomes
- Account-level suspicious activity patterns
What this report does not include: We do not disclose our detection algorithms, scoring thresholds, specific security infrastructure, or any information that could help attackers bypass our screening. Our goal is to inform the QR code industry about threat patterns, not to provide a roadmap for abuse.
For industry context throughout this report, we reference data from Keepnet Labs, Acronis, CNBC, the FBI IC3, Mordor Intelligence, and Statista.
QR Code URL Safety: The Big Picture
Approximately 85% of all URLs submitted to QRLynx pass automated security screening and are verified as safe for scanning. The remaining 15% are flagged for additional review before the QR code becomes active.
| Security Status | Percentage | What It Means for Scanners |
|---|---|---|
| Verified Safe | ~85% | URL passed all automated security checks — QR code activates immediately |
| Flagged for Review | ~15% | URL requires additional verification — QR code shows security interstitial until resolved |
| Elevated Threat | <1.5% | URL shows active phishing, malware, or brand impersonation indicators |
The 85% safe rate means the overwhelming majority of QR codes are legitimate. However, the 15% flagging rate shows that automated screening catches a meaningful volume of potentially problematic URLs before they reach consumers.
For context, Acronis reports that 12% of all phishing attacks in 2025 contained a QR code, and CNBC found that 26% of all malicious links are now delivered via QR codes. This means QR code generators are a critical chokepoint for preventing phishing URLs from reaching millions of smartphone scanners.
Among QR code generators that offer any form of URL screening, QRLynx is one of very few that publishes its screening data publicly. Most platforms provide no transparency into how many URLs they flag or what threats they detect.
Monthly Threat Trends: December 2025 to April 2026
QR code security is not static — threat patterns shift month to month. Our data reveals significant variation in flag rates across the 5-month analysis period.
| Month | QR Codes Created | Verified Safe | Flagged | Flag Rate |
|---|---|---|---|---|
| December 2025 | 43 | 41 | 2 | 4.7% |
| January 2026 | 143 | 143 | 0 | 0.0% |
| February 2026 | 130 | 125 | 5 | 3.8% |
| March 2026 | 227 | 167 | 60 | 26.4% |
| April 2026 | 491 | 407 | 84 | 17.1% |
March 2026 was the outlier — more than 1 in 4 QR codes created that month were flagged for security review. This spike coincided with a period of rapid platform growth (QR code volume nearly doubled from February) and a concentrated wave of submissions using newly registered domains.
By April, the flag rate normalized to 17.1% as the platform's screening pipeline adapted to new submission patterns. The overall trend shows that as QR code adoption grows (QR code volume increased 11x from December to April), the absolute number of flagged URLs grows proportionally — but the percentage remains manageable.
This pattern mirrors industry-wide data: Keepnet Labs reports that QR phishing attacks jumped 25% in 2025 alone, hitting over 26 million Americans with malicious links. Growth in QR code adoption inevitably brings growth in abuse attempts.
Risk Score Distribution: How Dangerous Are QR Code URLs?
Not all flagged URLs are equally dangerous. QRLynx's screening assigns a risk level to every URL, ranging from clean to high. Here is the distribution across all dynamic QR codes analyzed:
| Risk Level | Percentage | What It Indicates |
|---|---|---|
| Clean (score 0) | 71.9% | No risk indicators detected — established domain, clean reputation |
| Minimal (1-9) | 21.1% | Minor indicators present but within normal parameters |
| Low (10-19) | 5.6% | Some characteristics worth noting but not actionable |
| Moderate (20-29) | 1.0% | Multiple risk factors present — warrants closer review |
| Elevated (30-49) | 0.2% | Significant concern — security interstitial shown to scanners |
| High (50+) | 0.3% | Strong threat indicators — likely phishing, malware, or impersonation |
The good news: 71.9% of all QR code URLs have zero risk indicators. Combined with the 21.1% in the Minimal category, over 93% of QR code destinations are safe by any reasonable measure.
The concern: the 1.5% in Moderate-to-High categories represents real threats. At scale — with over 100 million Americans scanning QR codes in 2026 according to Statista — even 1.5% translates to millions of potentially dangerous scan events across the QR code ecosystem.
Why URLs Get Flagged: Top Verification Failure Reasons
When a QR code URL does not pass automated screening, the reason is logged. Here is the breakdown of why URLs get flagged on QRLynx:
| Reason | % of All Codes | Explanation |
|---|---|---|
| Domain too new (<30 days) | 4.7% | Freshly registered domain with no reputation history |
| Domain does not resolve | 3.5% | DNS lookup fails — domain may not exist or is pre-staged |
| Domain age unknown | 0.4% | Age could not be determined from DNS records |
| Flagged user account | 0.3% | Account has been flagged for prior suspicious activity |
New domains are the #1 reason URLs get flagged, accounting for 4.7% of all dynamic QR codes. This is consistent with broader phishing trends — the FBI's IC3 division has specifically warned that cybercriminals register fresh domains for QR code phishing campaigns because new domains have no reputation history to flag them.
Non-resolving domains (3.5%) are also concerning — a domain that does not resolve in DNS may be pre-staged for a future attack or may indicate a typosquatting attempt where the attacker has not yet configured the server.
Note: 80.6% of codes passed screening outright, and an additional 10% were auto-verified because they use non-URL QR types (WiFi, vCard, text) that do not link to external destinations.
The New Domain Problem: QR Phishing's Favorite Weapon
Newly registered domains are the single largest category of flagged QR code URLs. Our data shows exactly how new these domains are when they are submitted to a QR code generator:
| Domain Age | % of Flagged New Domains | Cumulative |
|---|---|---|
| 0 days (same day) | 24.5% | 24.5% |
| 1-7 days | 24.5% | 49.0% |
| 8-14 days | 22.4% | 71.4% |
| 15-29 days | 28.6% | 100% |
Nearly half (49%) of flagged new domains were registered less than one week before being submitted to a QR code generator. One in four were registered the same day — a strong indicator of disposable domains created specifically for a phishing campaign.
This pattern is well-documented in security research. Phishing attackers register domains at low cost ($1-5), use them for a single campaign, then abandon them before blocklists catch up. QR codes amplify this problem because a single printed code can be scanned by hundreds of people before anyone reports it.
Our recommendation for legitimate businesses: Register your domain at least 30 days before creating QR codes that point to it. Established domains with clean reputation history pass security screening without delay. If you are launching a new product or campaign on a fresh domain, expect automated screening to flag it — this is a necessary precaution, not a flaw.
QR Code Type Security: Which Types Are Safest?
Not all QR code types carry the same security risk. QR codes that link to external URLs face different threats than those encoding WiFi credentials, contact cards, or text.
| QR Code Type | Total Codes | Flag Rate | Risk Level |
|---|---|---|---|
| URL / Website | 733 | 12.6% | Higher (external destination) |
| PDF Document | 78 | 74.4%* | *Mostly auto-verified non-URL |
| Multi-Link / Bio Page | 74 | 0% | Self-hosted (no external URL) |
| Social Media (all) | 81 | 0% | Known platforms |
| Digital Business Card | 18 | 0% | Contact data only |
URL-type QR codes are the only type with meaningful security risk (12.6% flag rate) because they direct scanners to external websites that could host phishing pages, malware, or credential-harvesting forms.
Social media QR codes (Instagram, YouTube, TikTok, LinkedIn, Facebook, Spotify, WhatsApp) all have a 0% flag rate because they link to known, trusted platforms. Bio pages and multi-link pages are self-hosted on the QR code platform and face no external URL risk.
This data has a practical implication: if you are creating QR codes for social media or contact sharing, the security risk is effectively zero. The risk concentrates entirely in QR codes that link to custom URLs — especially on newly registered domains.
What Happens After a QR Code Is Blocked
One of the most striking findings from our data: blocked QR codes continue to receive an average of 3.3 scan attempts after deactivation. One blocked code received 45 scan attempts — the highest in our dataset.
| Metric | Value |
|---|---|
| Total scan attempts on blocked codes | 122 |
| Unique blocked codes scanned | 37 |
| Average attempts per blocked code | 3.3 |
| Maximum attempts on a single code | 45 |
| Users affected | 16 |
When a QR code is deactivated — whether by the owner, by platform moderation, or by automated security enforcement — it stops redirecting to the destination URL. But the physical QR code still exists. Printed on a flyer, sticker, or business card, it continues to be scanned.
The 3.3 average suggests most blocked codes receive a handful of scans from confused legitimate users. But the code with 45 attempts is different — that pattern suggests persistent targeting, possibly by an attacker checking whether their blocked code has been reactivated.
QRLynx tracks these deactivated scan events and alerts code owners when their blocked codes are being scanned. This data reinforces a key security principle: deactivating a QR code is not the same as destroying it. Businesses should physically remove or cover outdated QR codes whenever possible.
25 QR Code Security Statistics You Should Know in 2026
The following statistics combine original data from QRLynx's security pipeline with industry-wide findings from leading cybersecurity researchers. Each statistic includes its source for verification.
QRLynx Original Data (December 2025 — April 2026):
- 85% of QR code destination URLs pass automated security screening. (Source: QRLynx Security Pipeline, 2026)
- 15% of URLs are flagged for additional review before a QR code goes live. (Source: QRLynx, 2026)
- 71.9% of QR code URLs have zero risk indicators. (Source: QRLynx, 2026)
- Fewer than 1.5% of QR code URLs score Moderate risk or above. (Source: QRLynx, 2026)
- 4.7% of dynamic QR codes are flagged due to newly registered domains. (Source: QRLynx, 2026)
- 3.5% of QR code URLs point to domains that do not resolve in DNS. (Source: QRLynx, 2026)
- 49% of flagged new domains were registered less than 1 week before QR code creation. (Source: QRLynx, 2026)
- 24.5% of flagged new domains were registered the same day as QR code creation. (Source: QRLynx, 2026)
- March 2026 saw a 26.4% URL flag rate — the highest monthly rate in our dataset. (Source: QRLynx, 2026)
- URL-type QR codes have a 12.6% flag rate; social media QR codes have 0%. (Source: QRLynx, 2026)
- Blocked QR codes receive an average of 3.3 scan attempts after deactivation. (Source: QRLynx, 2026)
- One blocked QR code received 45 scan attempts after deactivation. (Source: QRLynx, 2026)
- Less than 1% of platform accounts are flagged for suspicious QR code creation patterns. (Source: QRLynx, 2026)
- QR code creation volume grew 11x from December 2025 to April 2026 on the QRLynx platform. (Source: QRLynx, 2026)
- 28 different QR code types are used across the platform, with URL codes representing 70.6% of all dynamic codes. (Source: QRLynx, 2026)
Industry-Wide QR Code Security Data:
- QR code phishing attacks grew 400% between 2023 and 2025. (Source: Keepnet Labs)
- 12% of all phishing attacks in 2025 contained a QR code. (Source: Acronis)
- 26% of all malicious links are now delivered via QR codes. (Source: CNBC)
- 73% of consumers scan QR codes without verifying the destination URL. (Source: Keepnet Labs)
- Over 4.2 million QR code phishing threats were identified in early 2025. (Source: Keepnet Labs)
- QR phishing attacks hit over 26 million Americans in 2025. (Source: Keepnet Labs)
- 89.3% of quishing attacks target credential theft. (Source: Keepnet Labs)
- Executives face 42x more QR phishing attacks than the average employee. (Source: Keepnet Labs)
- The global QR code market is projected to reach $33.14 billion by 2031. (Source: Mordor Intelligence)
- 102.6 million US smartphone users are projected to scan QR codes in 2026. (Source: Statista)
QR Code Security: Screened vs Unscreened Platforms
What happens when someone creates a QR code on a platform with security screening versus one without? The difference is significant.
| Scenario | With Automated Screening (QRLynx) | Without Screening (Most Free Generators) |
|---|---|---|
| Phishing URL submitted | Flagged and held before QR code goes live | QR code created and distributed immediately |
| New domain (0 days old) | Held for review, creator notified | No detection — code works immediately |
| Brand impersonation URL | Elevated threat flag, security interstitial shown to scanners | No warning to scanners |
| QR code later reported | Deactivated + owner notified + continued scan monitoring | No mechanism to disable or track |
| Consumer scans suspicious code | Security interstitial with URL preview and verification | Direct redirect to destination — no protection |
| Abuse monitoring | Real-time abuse reports with auto-escalation | None |
QR code generators without URL screening are effectively distribution tools for phishing. According to Keepnet Labs, 73% of people scan QR codes without verifying the destination URL. This makes the QR code generator the last line of defense between an attacker and a victim.
Platforms with automated screening act as a security checkpoint — catching threats before they are printed, distributed, and scanned by thousands of unsuspecting users. For more on QR code security features, see our complete QR Code Security Guide.
How to Protect Your Business from QR Code Threats
Use a QR code generator with built-in URL screening
Not all QR code generators scan destination URLs for threats. Choose a platform like QRLynx that automatically screens every URL through an automated security pipeline before the QR code goes live. Free generators that skip this step leave your customers exposed to phishing and malware.
Verify your domain before creating QR codes
If you are using a newly registered domain, expect it to be flagged by security-conscious platforms. Register your domain at least 30 days before creating QR codes that point to it. Use an established domain with a clean reputation history to avoid screening delays.
Use dynamic QR codes for sensitive destinations
Dynamic QR codes can be deactivated instantly if compromised. Static QR codes are permanent and cannot be changed or disabled after printing. For any URL that handles payments, logins, or personal data, always use dynamic codes with scan tracking enabled.
Monitor scan analytics for anomalies
Check your QR code scan analytics regularly for unusual patterns: sudden spikes in scans from unexpected countries, scans at unusual hours, or scans on codes you have deactivated. These can indicate your QR code has been replicated, tampered with, or is being targeted by attackers.
Set expiration rules on time-limited campaigns
QR codes for promotions, events, or temporary campaigns should have expiration dates. This prevents old codes from being reused or repurposed by attackers after the campaign ends. QRLynx supports both date-based and scan-count-based expiration rules.
Physically remove outdated QR codes
Deactivating a QR code digitally does not destroy the physical code. Printed QR codes on flyers, stickers, posters, and packaging continue to exist and get scanned. Remove or cover outdated QR codes whenever possible to prevent confusion and potential misuse.
Recommendations for Businesses and Consumers
For businesses creating QR codes:
- Always use a QR code generator with automated URL security screening — most free generators provide zero protection
- Use password protection for QR codes linking to sensitive or confidential content
- Monitor scan analytics weekly for anomalies — sudden scan spikes from unusual locations can indicate tampering or replication
- Set expiration rules on QR codes for time-limited promotions to prevent reuse after the campaign ends
- Physically remove or cover outdated QR codes — digital deactivation stops the redirect but the code still exists in the physical world
For consumers scanning QR codes:
- Check the URL preview before visiting — your phone shows the destination URL when you scan. Look for misspelled brand names, unfamiliar domains, and excessive subdomains
- Be suspicious of QR codes on stickers placed over other QR codes — this is a common physical tampering technique used to redirect scans to phishing sites
- Never enter login credentials, payment information, or personal data on a page you reached via an unknown QR code
- If a QR code leads to a security warning or interstitial page, take it seriously — the platform detected something worth flagging
- Report suspicious QR codes to the platform that hosts them — most reputable QR code generators have abuse reporting mechanisms
For detailed consumer safety guidance, see our QR Code Scams and Quishing Safety Guide. For businesses looking to understand QR code security architecture, see our Complete QR Code Security Guide.
Frequently Asked Questions
How many QR codes are used for phishing?
QR code phishing (quishing) attacks grew 400% between 2023 and 2025 according to Keepnet Labs. Acronis reports that 12% of all phishing attacks in 2025 contained a QR code. QRLynx data shows that approximately 1.5% of URLs submitted to QR code generators show elevated threat indicators, while 15% are flagged for additional review.
What percentage of QR code URLs are malicious?
Based on QRLynx data from 5M+ scans, approximately 85% of QR code destination URLs pass automated security screening. About 15% are flagged for additional review (mostly due to newly registered domains), and fewer than 1.5% show active threat indicators like phishing or malware patterns.
How do you detect a fake QR code?
Look for physical signs of tampering: stickers placed over existing QR codes, codes in unusual locations, or QR codes with no context about what they link to. When you scan, check the URL preview on your phone before visiting. If the URL looks suspicious — misspelled brand names, excessive subdomains (paypal.com.attacker.xyz), or unfamiliar domains — do not proceed.
What is quishing and how common is it?
Quishing is phishing via QR codes — attackers create QR codes that link to fake login pages or malware download sites. It has become one of the fastest-growing cyber threats, with attacks increasing 400% since 2023. CNBC reports that 26% of all malicious links are now delivered via QR codes, and over 26 million Americans were targeted by QR phishing in 2025.
Can a QR code give you a virus?
A QR code itself cannot contain a virus — it only stores a URL or text. However, the website it links to can host malware or prompt you to download malicious files. This is why scanning a QR code from an unknown source carries the same risk as clicking an unknown link in an email. Use a QR code generator with URL screening to minimize this risk.
How do QR code generators protect against phishing?
Security-conscious QR code generators like QRLynx screen every destination URL through automated multi-layer security analysis before the QR code goes live. URLs that fail screening are flagged, held for review, or blocked. At scan time, suspicious codes display a security interstitial warning the scanner before redirecting. Most free QR generators provide no URL screening at all.
What is a QR code security interstitial?
A security interstitial is a warning page shown between scanning a QR code and reaching its destination. It displays the full URL, a security notice, and a human verification check (such as Cloudflare Turnstile). This gives scanners a chance to verify the destination is legitimate before proceeding. QRLynx shows interstitials for QR codes with unverified or suspicious URLs.
What are the most common QR code scams?
The most common QR code scams include: fake parking meter payment codes, restaurant menu QR codes replaced with phishing stickers, fake package delivery notifications, cryptocurrency scam codes, and QR codes on phishing emails that bypass text-based email filters. Newly registered domains are the #1 indicator of QR code phishing according to QRLynx data.
How can businesses protect their QR codes from tampering?
Use dynamic QR codes that can be deactivated instantly if compromised. Monitor scan analytics for unusual patterns — sudden spikes from unexpected countries or times indicate tampering. Place QR codes in tamper-evident locations or use branded codes that are harder to replicate. Set expiration rules for time-limited campaigns. Physically remove QR codes when they are no longer needed.
What is the safest QR code generator?
The safest QR code generators are those that automatically screen destination URLs for threats, provide real-time scan monitoring, show security warnings to scanners when suspicious content is detected, and allow instant deactivation of compromised codes. QRLynx screens every URL through automated security analysis and provides both creation-time and scan-time protection.
Do phone QR code scanners check for malware?
Most built-in phone QR code scanners (iPhone Camera, Google Lens) do NOT check for malware — they simply decode the URL and offer to open it in the browser. Some third-party scanner apps include basic URL reputation checks. The most effective protection comes from the QR code generator itself screening URLs before the code is created and showing interstitials at scan time.
How often should businesses audit their QR codes for security?
Review your active QR codes monthly. Check scan analytics for anomalies: unexpected countries, unusual time patterns, and scan spikes on specific codes. Verify that all destination URLs still resolve to the correct pages. Deactivate codes that are no longer needed. For high-security use cases (payments, logins, employee access), audit weekly and use password-protected dynamic codes.
