SecQR Scan: A Secure Scanning Framework to Protect Against Malicious QR Codes

QR codes have become highly ubiquitous in modern digital interactions. They enable fast and convenient payments, authentication, marketing, and information access via smart devices. However, their widespread adoption has also led to emerging threats such as QR phishing ("Quishing"), QR-jacking, and malware distribution. In this paper, we present SecQR Scan, a secure scanning framework that detects, prevents, and reports malicious QR code interactions. SecQR Scan combines on-device scanning, threat intelligence checks, machine learning-based risk classification, and sandboxed in-app browsing to provide a safe and user-aware scanning experience. Users are presented with metadata and traffic-light risk indicators before interacting with the contents of the QR codes. We describe the design and implementation of a fully functional Android prototype, encompassing five key components: scanning and preprocessing, threat intelligence analysis, ML-based classification, secure browsing, and user decision support. The Android app and preliminary results demonstrate SecQR Scan’s ability to detect malicious QR codes effectively while maintaining usability, providing a practical end-to-end solution for security against malicious QR codes in both consumer and enterprise applications.