Abstract
QR code usage has increased rapidly in digital payments, online shopping, ticket booking, and business
applications. However, attackers exploit this popularity by embedding malicious URLs inside QR codes, leading
users to phishing websites that can steal usernames, passwords, banking credentials, and personal data. Since the
destination URL is hidden until the QR code is scanned, users cannot easily verify whether it is safe before
accessing it. SafeScan – Proactive Mobile Defense Against QR Code Phishing (Quishing) provides a security
layer that analyzes a QR destination before direct navigation. The proposed system uses React Native with Expo
for the mobile application and FastAPI with Python for the backend. After scanning a QR code, the system extracts
the embedded URL, expands shortened links, validates the destination, performs heuristic-based security analysis,
calculates a risk score, and classifies the URL as Low, Medium, or High risk. To improve user awareness, the
backend can generate a webpage preview using Playwright and headless Chromium in a controlled environment.
The mobile application presents the decoded or expanded URL, risk score, verdict, preview, and recommended
action without automatically opening the destination. Functional testing in the project demonstrates the complete
workflow from QR acquisition to safety reporting and controlled handling of invalid inputs and connectivity
failures. SafeScan therefore provides an interpretable, mobile-oriented baseline for reducing exposure to QRbased phishing and supporting safer navigation decisions.
References
1) Reinheimer, B., Schaub, F., Mare, S., & Egelman, S. (2015). QR Code Security: A Study of Mobile QR
Code Scanner Applications. Proceedings of the 10th International Conference on Availability, Reliability
and Security (ARES), IEEE.
2) Rafsanjani, A. S., Kamaruddin, N. B., Rusli, H. M., & Dabbagh, M. (2023). QSecR: Secure QR Code
Scanner According to a Novel Malicious URL Detection Framework. IEEE Access, Vol. 11, pp. 92523–
92539.
3) Sharevski, F., Devine, A., Pieroni, E., & Jachim, P. (2022). Gone Quishing: A Field Study of Phishing
with Malicious QR Codes. arXiv Preprint, Cornell University.
4) Akram, M. H., Sood, K., Hassan, M. U., & Subba, B. (2025). Exemplifying Emerging Phishing: QRBased Browser-in-The-Browser Attack. IEEE Networking Letters.
5) Jain, A. K., & Gupta, B. B. (2018). Towards Detection of Phishing Websites Using Machine Learning
Techniques. Telecommunication Systems, Springer Nature.
6) Abdelhamid, N., Ayesh, A., & Thabtah, F. (2014). Phishing Detection Based on Machine Learning and
URL Features. Journal of Information Security and Applications, Elsevier.
7) Gupta, B. B., Arachchilage, N. A. G., & Psannis, K. E. (2018). Defending Against Phishing Attacks:
Taxonomy of Methods, Current Issues, and Future Directions. Telecommunication Systems, Springer.
8) Wang, Y. (2022). A Survey of Phishing Detection: From an Intelligent Countermeasures Perspective.
Proceedings of the International Conference on Telecommunications, Optics and Computer Science
(TOCS), IEEE.
9) Google LLC. (2024). Google Safe Browsing API Documentation. Google Developers.
10) Microsoft Corporation. (2024). Playwright for Python Documentation. Microsoft Learn.
11) FastAPI Developers. (2024). FastAPI Official Documentation. FastAPI Technologies.
12) OWASP Foundation. (2024). OWASP Phishing Prevention Cheat Sheet. OWASP Project
Documentation.
13) OpenCV Team. (2024). OpenCV Documentation: Computer Vision Library. OpenCV Foundation.
14) Meta Platforms Inc. (2024). React Native Official Documentation. Meta Open Source.
15) Expo Developers. (2024). Expo SDK Documentation. Expo Documentation.