Dynamic QR Codes Enable Personalized Redirects and Conceal Final Destinations

Dynamic QR codes, now common on café menus, flyers, and invoices, do not embed the final web address. They contain only a short link to an intermediary service that records the scan and then redirects the user.

In a static QR code the target URL is fixed at creation and cannot be altered without reprinting the image. A dynamic code stores a short link such as qr-service.example/a1b2c3. When scanned, the service logs the event and returns an HTTP redirect to the current destination chosen by the code owner.

This architecture lets owners update the landing page after printing, yet it also produces three privacy and security consequences that users rarely consider. The destination can change long after the code is distributed. The service can return different pages to different visitors based on device, language, location, or scan history. Every scan is logged with timestamp, device information, and approximate geolocation.

Smartphone cameras usually display the intermediate short link before navigation, but this address reveals nothing about the final page. To inspect the complete redirect chain from a non-mobile environment, the following command can be used:

curl -sL -o /dev/null -w '%{url_effective}\n' 'https://qr-service.example/a1b2c3'

Even this method may return a different result if the service tailors responses to client characteristics.

Practical risks include adhesive stickers placed over legitimate codes on payment terminals and parking machines, QR codes embedded in email attachments that evade URL filters, and fraudulent payment flows that open ordinary web forms instead of triggering a bank QR payment. In all payment cases the application must display the exact amount and recipient before confirmation.

Users are advised to examine the displayed short link, avoid scanning codes received in messages, verify payment details inside the banking app, and check physical codes for signs of tampering.