QR code protection
Decodes a QR code and checks where it really points before you pay or open it.
- Available
- 02
- Limited
- 02
- Not released
- 00
- Coming
- 00
How the attack works
A QR code is a link or a payment instruction you cannot read. "Quishing" swaps or prints a code that sends you to a phishing page or a different payee, and it works because people trust a code that is physically in front of them.
- STAGE 01
Placement
A sticker over a parking-meter or shop code, a code in a flyer or email, or a code sent by a "buyer" who wants to pay you.
- STAGE 02
Scan
The phone opens a link or a payment app with the payee and amount already filled in.
- STAGE 03
Misdirection
The page asks for a login or card details, or the payment goes to the attacker's account.
- STAGE 04
Reversal trick
A "receive money" code that is actually a collect request: scanning and entering your PIN sends money instead of receiving it.
- Shoppers paying at counters and parking meters
- Online sellers told to "scan to receive payment"
- Employees sent QR codes in email to bypass link filters
A common pattern: a seller on a classifieds site is sent a QR code by an interested "buyer" with a message that scanning it will credit the payment. Scanning opens a payment request; entering the UPI PIN authorises a debit. You never need a PIN to receive money.
A sticker over a parking-meter or shop QR code sends payments or logins somewhere else. You cannot read a QR code by eye.
Sensor, rule, evidence, action
Each step carries its own state. A step that is not built is shown as coming, not skipped.
Decode the code
The phone camera scans the code and decodes it on the phone; you can also pick a picture. Several codes in one picture let you choose.
AvailableAndroid 4.50Destination and payee checks
The decoded link goes through the same link heuristics; a payment code shows the payee identifier in plain text.
LimitedAndroid 4.50Plain-text destination
You see exactly where the code points before anything opens.
Not releasedShow, do not open
The result is shown to you; nothing is opened or paid automatically.
Not released
Decode first, show the destination in plain text, then run the same link and payment checks as above.
For payment QR codes, show the payee identifier so you can compare it with what you expect.
What works today, and what is coming
What works today
04In production or in the current download.
- Camera QR scannerAvailable
Scans with the phone camera; the code is decoded on the phone.
Android app 4.50
- QR result, link safety and payment-QR checksLimited
Shows where the code points and runs the link and payment checks; the payee of a payment code is shown so you can compare it.
Android app 4.50
- Scan a QR code from a pictureLimited
Pick a screenshot or photo; it is read on the phone and neither kept nor sent. If a picture holds several codes you choose one.
Android app 4.50
- QR scan historyAvailable
Past scans, kept on the phone.
Android app 4.50
Built, not yet released
00The code exists and is tested in the repository; it has not shipped to users.
Nothing in this group yet.
Coming
00Not built yet. Nothing on this list runs today.
Nothing in this group yet.
2 attack families map to this capability
Copied row by row from our engineering register. A family counts as detected only when a rule, a sensor that feeds it and a test that makes it fire all exist.
Feature states above and register statuses measure different things: a feature can be built while the family it addresses stays unobserved, because the register counts sensors and rules, not screens.
| # | Attack family | Status | What the register says |
|---|---|---|---|
| 037 | QR / Quishing | No sensor | No QR decoding found in the code the register reviewed.Nothing runs |
| 100 | Payment / UPI Fraud | No sensor | No payment or UPI telemetryNothing runs |
What runs where, and what never leaves
Classification happens on the device before anything is queued. Cloud reporting is off by default on consumer devices and turning it off also stops events already queued.
Runs on the device
- The decoded content of the code
- Link and payment-pattern checks
May reach the cloud
- Only with cloud reporting on: the verdict and the hostname
Never leaves
- The full decoded URL or payment string
- Your payment credentials or PIN
Editions that include it
Android protection you can install today.
> Android phone owners
Local-first protection for your own computer and phone.
> One person, 1–3 devices
One summary for the whole household, without reading anyone's phone.
> Households with supported paired phones
Each feature above names the platform or edition it runs on. An edition's own page lists the full state of that edition.
What to do if…
Practical steps that work whether or not you use our products.
You are about to pay with a QR code
- 1.Check the payee name your payment app shows before entering the PIN.
- 2.At a counter, look for a sticker placed over the original code.
- 3.If the amount is pre-filled and unexpected, stop and ask.
Someone sends you a code "to receive money"
- 1.Do not scan it. Receiving money never needs your PIN.
- 2.Give the buyer your UPI ID and let them pay you.
You already paid the wrong payee
- 1.Call your bank's fraud line at once and raise a dispute in the payment app.
- 2.In India, report on 1930 or cybercrime.gov.in.
Limits and known gaps
- GAP-01The checks are heuristics plus the signed blocklist; there is no shared reputation service, so an unknown link is called unknown, never safe.
- GAP-02The register records QR/quishing and payment/UPI fraud as not observable: it found no QR decoding or payment telemetry in the code it reviewed.
- GAP-03Payee checks show you the identifier; there is no shared database of known fraudulent payees.
Frequently asked
Can I scan a code with the app today?
Is a QR code on an official-looking poster safe?
Capabilities that work alongside it
Checks a link before you open it and warns about lookalike domains.
Checks a message, payment request or caller against known scam patterns, on the device.
DNS filtering and your own blocked and allowed lists on the phone; page-level browser protection is not built.