Thousands of football fans pulled out their phones. A giant QR code appeared on the stadium screen. Within moments, the crowd had transformed into a synchronised light show, with thousands of smartphone flashlights flashing in perfect harmony.
It was visually spectacular.
But as developers of QR security technology, we couldn’t help but ask a different question:
What if that QR code hadn’t been benign?
A Moment That Shows How Much We Trust QR Codes
The demonstration itself was clever. Fans scanned a QR code that opened a web application capable of controlling their phone’s flashlight (after requesting the appropriate permissions). The result was an immersive stadium experience involving tens of thousands of devices working together.
What concerns us isn’t the technology behind the light show.
It’s how effortlessly thousands of people were conditioned to scan an unfamiliar QR code simply because it appeared on a trusted screen.
No hesitation.
No verification.
Just scan.
Trust Is Exactly What Attackers Exploit
Cybercriminals have long understood that people don’t click links because they trust the link—they click because they trust the context.
Imagine the same scenario.
A packed World Cup stadium.
The same giant screen.
The same instruction to scan.
Now imagine that QR code had instead directed users to:
- A convincing fake ticketing portal requesting account credentials.
- A fake Wi-Fi login page harvesting email addresses and passwords.
- A fraudulent competition asking for payment details.
- A malicious website requesting notification permissions before bombarding users with scam alerts.
- A phishing page impersonating FIFA, a sponsor, or even a mobile wallet.
Most modern smartphones won’t usually become infected simply by scanning a QR code or visiting a legitimate-looking website. Browsers include significant security protections, and users typically have to grant permissions or provide information before real harm occurs.
However, phishing doesn’t rely on software vulnerabilities.
It relies on trust.
And that trust was demonstrated at enormous scale.
The Real Risk Wasn’t the Technology—It Was the Behaviour
QR codes have become part of everyday life.
Restaurant menus.
Parking payments.
Train tickets.
Parcel collections.
Concerts.
Sporting events.
Because scanning has become routine, we rarely stop to ask a simple question:
Should I trust where this code is taking me?
Events like the World Cup unintentionally reinforce that behaviour. When one of the world’s biggest sporting organisations encourages tens of thousands of people to scan a code without a second thought, it further normalises a habit that attackers are already exploiting.
One Malicious QR Code Could Reach Thousands in Seconds
This is what makes large public events so attractive from a cybersecurity perspective.
Instead of targeting individuals one by one, attackers dream about environments where people willingly participate together.
If even 30,000 spectators scanned a malicious QR code, the potential impact could be enormous.
Even if only:
- 10% entered credentials,
- 5% submitted payment information,
- or 2% approved malicious permissions,
that still represents hundreds—or even thousands—of compromised users from a single attack.
Cybercriminals don’t need everyone.
They only need enough.
Ironically, Even FIFA Understands the Risk
Interestingly, tournament organisers have already recognised the security implications of QR codes in other contexts.
During recent FIFA competitions, players and media personnel were instructed to hide accreditation passes because visible QR codes could potentially be copied and used to create fraudulent credentials for restricted stadium areas.
That demonstrates an important point:
QR codes themselves aren’t usually dangerous—but they become dangerous when people trust them blindly.
So Should We Stop Using QR Codes?
Absolutely not.
QR codes are incredibly useful when they’re used responsibly.
The answer isn’t to stop scanning.
It’s to start verifying.
Before interacting with any QR code, ask yourself:
- Does this QR code come from a trusted source?
- Does the website match the organisation you expected?
- Am I being asked for information that seems unnecessary?
- Does this permission request actually make sense?
- Would I click this same link if it arrived by email?
Those few seconds of verification can prevent hours—or even months—of dealing with fraud.
The World Cup light show was an impressive demonstration of modern technology and fan engagement.
But it also served as a reminder of something much bigger.
Thousands of people instinctively scanned a QR code because everyone else was doing it and because they trusted the environment.
That’s exactly the kind of behaviour cybercriminals hope for.
The future of QR technology isn’t about making people afraid to scan—it’s about making sure every scan is a safe one.
That’s why we built QR Guardian. Instead of asking users to manually inspect every QR code or second-guess every destination, QR Guardian checks QR codes before you visit them, helping you identify potentially malicious links and reducing the risk of phishing attacks, fake websites and other QR-based scams.
Download QR Guardian today and remove the guesswork from QR security. Whether you’re scanning a code at a stadium, restaurant, car park or airport, you can scan with confidence knowing QR Guardian is helping to keep you safe.
